Subject: Re: [OAUTH-WG] treatment of client_id for authentication and identification

From: Eran Hammer-Lahav <[email-masked]>
Date: Sun, 14 Aug 2011 23:27:22 -0700

Added to 2.4.1:

client_secret
                REQUIRED. The client secret. The client MAY omit the parameter if the client secret
                is an empty string.

Added to 3.2.1:

            A public client that was not issued a client password MAY use the
            'client_id' request parameter to identify itself when sending
            requests to the token endpoint.

EHL

> -----Original Message-----
> From: Brian Campbell [mailto:[email-masked]]
> Sent: Thursday, July 28, 2011 12:11 PM
> To: Eran Hammer-Lahav
> Cc: Torsten Lodderstedt; oauth
> Subject: Re: [OAUTH-WG] treatment of client_id for authentication and
> identification
> 
> I would be very much in favor of that addition/clarification.
> 
> On Thu, Jul 28, 2011 at 9:20 AM, Eran Hammer-Lahav
> <[email-masked]> wrote:
> >
> > [...] and I can also add a short note that public clients may use the
> > client_id for the purpose of identification with the token endpoint.
> > EHL
> >

---

From: "Lu, Hui-Lan (Huilan)" <[email-masked]>
Date: Thu, 18 Aug 2011 15:45:08 -0500

>                 REQUIRED. The client secret. The client MAY omit the parameter if the

I would suggest rewording the above as follows:
client_secret 
	REQUIRED unless it is an empty string. The client secret.

>             requests to the token endpoint.

It is difficult to parse the last sentence of 3.2.1: "The security ramifications of allowing unauthenticated access by public clients to the token endpoint MUST be considered, as well as the issuance of refresh tokens to public clients, their scope, and lifetime."

I think it should be rewritten and reference relevant parts of security considerations.

Huilan

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Thu, 18 Aug 2011 14:16:29 -0700

> From: Lu, Hui-Lan (Huilan) [mailto:[email-masked]]
> Sent: Thursday, August 18, 2011 1:45 PM
> To: Eran Hammer-Lahav; Brian Campbell
> Cc: oauth
> Subject: RE: [OAUTH-WG] treatment of client_id for authentication and
> identification
> 
> Eran Hammer-Lahav wrote:
> > Added to 2.4.1:
> >
> > client_secret

"unless its value is an empty string". Do people read this new text to mean OPTIONAL if not empty?

> It is difficult to parse the last sentence of 3.2.1: "The security ramifications of
> allowing unauthenticated access by public clients to the token endpoint
> MUST be considered, as well as the issuance of refresh tokens to public
> clients, their scope, and lifetime."
> 

Text?

EHL

---

From: Brian Campbell <[email-masked]>
Date: Thu, 18 Aug 2011 15:24:34 -0600

FWIW, I was okay with the text EHL had originally proposed for 21.

---

From: "Lu, Hui-Lan (Huilan)" <[email-masked]>
Date: Thu, 18 Aug 2011 16:47:10 -0500

> > I think it should be rewritten and reference relevant parts of security

Here is my stab:
Allowing unauthenticated access by public clients has security ramifications. So does the issuance of refresh tokens to public clients. Such security ramifications MUST be considered. See section 10 for further details.

Huilan

---

From: "Lu, Hui-Lan (Huilan)" <[email-masked]>
Date: Thu, 18 Aug 2011 17:13:40 -0500

I just noticed that some words were missing in my previous post. Here is the full text that Eran requested:

Allowing unauthenticated access to the token endpoint by public clients has security ramifications. So does
issuing refresh tokens to public clients. Such security ramifications MUST be considered. See section 10 for further details.

Huilan

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Lu,
> Hui-Lan (Huilan)
> Sent: Thursday, August 18, 2011 5:47 PM
> To: 'Eran Hammer-Lahav'; Brian Campbell
> Cc: oauth
> Subject: Re: [OAUTH-WG] treatment of client_id for authentication and identification
> 
> Allowing unauthenticated access by public clients has security ramifications. So does
> the issuance of refresh tokens to public clients. Such security ramifications MUST be
> considered. See section 10 for further details.
> 
> Huilan
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: "Richer, Justin P." <[email-masked]>
Date: Fri, 19 Aug 2011 07:55:56 -0400

I find the original text clearer, myself.

 -- Justin
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Eran Hammer-Lahav [[email-masked]]
Sent: Thursday, August 18, 2011 5:16 PM
To: Lu, Hui-Lan (Huilan); Brian Campbell
Cc: oauth
Subject: Re: [OAUTH-WG] treatment of client_id for authentication and identification

Text?

EHL