Subject: [OAUTH-WG] Clarification of "client application consisting of multiple components"

From: nov matake <[email-masked]>
Date: Mon, 12 Mar 2012 00:25:27 +0900

Hi,

I just found this sentence in the latest draft.

Does it mean "an application consisting of server-side and client-side component (eg. foursquare iPhone app) MUST have separate client_id for each component" ?
Or can I image something like Facebook is doing right now? (register each component for a single client_id separately)

==
A client application consisting of multiple components, each with its
own client type (e.g. a distributed client with both a confidential
server-based component and a public browser-based component), MUST
register each component separately as a different client to ensure
proper handling by the authorization server.  The authorization
server MAY provider tools to manage such complex clients through a
single administration interface.
==

--
nov <[email-masked]>

---

From: Eran Hammer <[email-masked]>
Date: Sun, 11 Mar 2012 08:57:22 -0700

If you have two components each with different security profile, you must assign each a different client_id. Otherwise, there is no way to enforce the rest of the spec's security requirements.

EH

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of nov matake
> Sent: Sunday, March 11, 2012 8:25 AM
> To: [email-masked] WG
> Subject: [OAUTH-WG] Clarification of "client application consisting of multiple
> components"
> 
> Hi,
> 
> Does it mean "an application consisting of server-side and client-side
> component (eg. foursquare iPhone app) MUST have separate client_id for
> each component" ?
> Or can I image something like Facebook is doing right now? (register each
> component for a single client_id separately)
> 
> ==
> A client application consisting of multiple components, each with its own
> client type (e.g. a distributed client with both a confidential server-based
> component and a public browser-based component), MUST register each
> component separately as a different client to ensure proper handling by the
> authorization server.  The authorization server MAY provider tools to manage
> such complex clients through a single administration interface.
> ==
> 
> --
> nov <[email-masked]>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: nov matake <[email-masked]>
Date: Mon, 12 Mar 2012 02:21:18 +0900

So what is the usecase of response_type=token%20code ?
I thought, in that usecase, token was for the client's client-side component, code was for the client's server-side component, and both of them have the same client_id.

--
nov

---

From: Eran Hammer <[email-masked]>
Date: Sun, 11 Mar 2012 10:30:04 -0700

That use case was removed from the specification. Either way, it is up to the authorization server to decide which registration options to offer the client if they make such a grant type available in the future, and how it will apply the security policies. IOW, those proposing such an extension in the future will have to figure out how this should be handled.

EH

> From: nov matake [mailto:[email-masked]]
> Sent: Sunday, March 11, 2012 10:21 AM
> To: Eran Hammer
> Cc: nov matake; [email-masked] WG
> Subject: Re: [OAUTH-WG] Clarification of "client application consisting of
> multiple components"
> 
> I thought, in that usecase, token was for the client's client-side component,
> code was for the client's server-side component, and both of them have the
> same client_id.
> 
> --
> nov
> 
> > If you have two components each with different security profile, you must
> assign each a different client_id. Otherwise, there is no way to enforce the
> rest of the spec's security requirements.
> >
> > EH
> >
> >> From: [email-masked] [mailto:[email-masked]] On
> >> Behalf Of nov matake
> >> Subject: [OAUTH-WG] Clarification of "client application consisting
> >> of multiple components"
> >>
> >> Hi,
> >>
> >> Does it mean "an application consisting of server-side and
> >> client-side component (eg. foursquare iPhone app) MUST have separate
> >> client_id for each component" ?
> >> Or can I image something like Facebook is doing right now? (register
> >> each component for a single client_id separately)
> >>
> >> ==

---

From: nov matake <[email-masked]>
Date: Mon, 12 Mar 2012 02:43:26 +0900

I understood.
Thanks.

--
nov