Subject: [OAUTH-WG] [Editorial Errata Reported] RFC6749 (3446)

From: RFC Errata System <[email-masked]>
Date: Mon, 7 Jan 2013 17:19:35 -0800 (PST)

The following errata report has been submitted for RFC6749,
"The OAuth 2.0 Authorization Framework".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=6749&eid=3446

--------------------------------------
Type: Editorial
Reported by: Nov Matake <[email-masked]>

Section: 1

Original Text
-------------
Resource owners cannot revoke access to an individual third party without revoking access to all third parties, and must do so by changing the third party's password.

Corrected Text
--------------
Resource owners cannot revoke access to an individual third party without revoking access to all third parties, and must do so by changing their password.

Notes
-----
The text was originally "their" but changed to "the third party's" between the last draft and RFC.
However, "their" means "resource owners'", not "the third party's".

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC6749 (draft-ietf-oauth-v2-31)
--------------------------------------
Title               : The OAuth 2.0 Authorization Framework
Publication Date    : October 2012
Author(s)           : D. Hardt, Ed.
Category            : PROPOSED STANDARD
Source              : Web Authorization Protocol
Area                : Security
Stream              : IETF
Verifying Party     : IESG

---

From: Barry Leiba <[email-masked]>
Date: Mon, 7 Jan 2013 21:11:33 -0500

> Corrected Text
> --------------
> Resource owners cannot revoke access to an individual third party without revoking access
> to all third parties, and must do so by changing their password.
>
> Notes
> -----

Yes, this appears to be a change the RFC Editor made that the authors
didn't notice in AUTH48.  But the RFC Editor change it from "their"
because "their" wasn't clear.  Changing it back to "their" won't help
that.  I suggest editing the corrected text to "by changing the
resource owner's password" before marking this as Verified.

Barry

---

From: Derek Atkins <[email-masked]>
Date: Wed, 09 Jan 2013 18:02:40 -0500

> resource owner's password" before marking this as Verified.

Yep, I suggested that same change in a private email to Stephen, so I
would prefer this modification.

> Barry

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 09 Jan 2013 23:24:50 +0000

> would prefer this modification.

Ok, assuming nobody objects I'll verify this that way tomorrow.

Cheers,
S

---

From: nov matake <[email-masked]>
Date: Thu, 10 Jan 2013 08:40:23 +0900

thanks!

nov

On Jan 10, 2013, at 8:24 AM, Stephen Farrell <[email-masked]> wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth