Subject: [OAUTH-WG] draft-richer-oauth-introspection-01 scope syntax

From: Todd W Lainhart <[email-masked]>
Date: Wed, 30 Jan 2013 17:27:11 -0500

That the scope syntax in draft-richer-oauth-introspection-01 is different 
than RFC 6749 Section 3.3, as in:

   "scope": ["read", "write", "dolphin"],

vs.

  scope = scope-token *( SP scope-token )
      scope-token = 1*( %x21 / %x23-5B / %x5D-7E )

Should introspection-01 follow the 6749 syntax for scopes?

---

From: Justin Richer <[email-masked]>
Date: Wed, 30 Jan 2013 17:29:17 -0500

It's not meant to follow the same syntax. Instead, it's making use of 
the JSON object structure to avoid additional parsing of the values on 
the client side.

We could fairly easily define it as the same space-delimited string if 
enough people want to keep the scope format consistent.

  -- Justin

On 01/30/2013 05:27 PM, Todd W Lainhart wrote:
> That the scope syntax in draft-richer-oauth-introspection-01 is 
> different than RFC 6749 Section 3.3, as in:
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Mike Jones <[email-masked]>
Date: Wed, 30 Jan 2013 22:31:01 +0000

Let JSON do the parsing for you

From: [email-masked] [mailto:[email-masked]] On Behalf Of Justin Richer
Sent: Wednesday, January 30, 2013 2:29 PM
To: Todd W Lainhart
Cc: IETF oauth WG
Subject: Re: [OAUTH-WG] draft-richer-oauth-introspection-01 scope syntax

It's not meant to follow the same syntax. Instead, it's making use of the JSON object structure to avoid additional parsing of the values on the client side.

We could fairly easily define it as the same space-delimited string if enough people want to keep the scope format consistent.

 -- Justin
On 01/30/2013 05:27 PM, Todd W Lainhart wrote:
That the scope syntax in draft-richer-oauth-introspection-01 is different than RFC 6749 Section 3.3, as in:

vs.

OAuth mailing list

[email-masked]<mailto:[email-masked]>

---

From: Justin Richer <[email-masked]>
Date: Wed, 30 Jan 2013 17:33:30 -0500

I should add that this is also a bit of an artifact of our 
implementation. Internally, we parse and store scopes as collections of 
discrete strings and process them that way. So serialization of that 
value naturally fell to a JSON list.

  -- Justin

---

From: Craig McClanahan <[email-masked]>
Date: Wed, 30 Jan 2013 14:47:54 -0800

> enough people want to keep the scope format consistent.
Can't we have our cake and eat it too, and accept either syntax?  JSON
makes it pretty easy to introspect what's there and deal with either
version appropriately.

I am one of those that finds the array version of things like this more
convenient, but for the folks who are used to dealing with the
space-delimited string version of scopes, we could easily support that too.

> Craig McClanahan

---

From: Mike Jones <[email-masked]>
Date: Wed, 30 Jan 2013 22:50:56 +0000

Having two ways to do something almost always hurts interop and always makes implementations bigger

From: [email-masked] [mailto:[email-masked]] On Behalf Of Craig McClanahan
Sent: Wednesday, January 30, 2013 2:48 PM
To: Justin Richer
Cc: IETF oauth WG
Subject: Re: [OAUTH-WG] draft-richer-oauth-introspection-01 scope syntax

On Wed, Jan 30, 2013 at 2:29 PM, Justin Richer <[email-masked]<mailto:[email-masked]>> wrote:
We could fairly easily define it as the same space-delimited string if enough people want to keep the scope format consistent.

Can't we have our cake and eat it too, and accept either syntax?  JSON makes it pretty easy to introspect what's there and deal with either version appropriately.

I am one of those that finds the array version of things like this more convenient, but for the folks who are used to dealing with the space-delimited string version of scopes, we could easily support that too.

 -- Justin

Craig McClanahan

---

From: "Donald F Coffin" <[email-masked]>
Date: Wed, 30 Jan 2013 22:41:08 -0800

Justin,

>From a purely implementation view, since RFC 6749 has already defined Scope,
I think it will only confuse implementers if the format of Scope is not
consistent.  In defining how to merge RFC 6749 with the ESPI Standard, I
have found the Scope parameter to be one of hardest concepts to describe how
to implement and evaluate its contents.  To begin using multiple formats to
define the same parameter will only lead to confusion and chaos.

While I understand the end result of parsing the Scope parameter naturally
leads to an array.  I view that as an implementation issue and not relevant
to a specification, especially since RFC 6749 has already set a
documentation precedent..

Best regards,

Don

Donald F. Coffin

Founder/CTO

REMI Networks

22751 El Prado Suite 6216

Rancho Santa Margarita, CA  92688-3836

Phone:      (949) 636-8571

Email:        <mailto:[email-masked]>
[email-masked]

From: Justin Richer [mailto:[email-masked]] 
Sent: Wednesday, January 30, 2013 2:29 PM
To: Todd W Lainhart
Cc: IETF oauth WG
Subject: Re: [OAUTH-WG] draft-richer-oauth-introspection-01 scope syntax

It's not meant to follow the same syntax. Instead, it's making use of the
JSON object structure to avoid additional parsing of the values on the
client side.

 -- Justin

vs.

---

From: Sergey Beryozkin <[email-masked]>
Date: Thu, 31 Jan 2013 09:56:26 +0000

Hi Justin
> enough people want to keep the scope format consistent.
IMHO the consistency in representing such a high-visibility parameter as 
'scope' is more important than providing for an option to immediately 
feed it into a JSON parser

thanks, Sergey

---

From: Todd W Lainhart <[email-masked]>
Date: Thu, 31 Jan 2013 09:38:34 -0500

I would vote for consistency with 6749 - string tokenizing doesn't seem 
like a big deal, esp. since clients are going to have to deal with it when 
scopes are returned from the token endpoint.  It was raised here when I 
realized that we would have to give clients two types of guidance when 
dealing with scopes in the introspection response and 6749 endpoints.

If the thinking is that 6749 got it wrong (didn't use JSON syntax 
appropriately), and this is getting it right, that's fine.  I'm more 
interested in knowing if the community thinks it's going to change.

Todd Lainhart
Rational software
IBM Corporation
550 King Street, Littleton, MA 01460-1250
1-978-899-4705
2-276-4705 (T/L)
[email-masked]

From:   Justin Richer <[email-masked]>
To:     Todd W Lainhart/Lexington/IBM@IBMUS, 
Cc:     IETF oauth WG <[email-masked]>
Date:   01/30/2013 05:29 PM
Subject:        Re: [OAUTH-WG] draft-richer-oauth-introspection-01 scope 
syntax

 -- Justin

vs.