Subject: [OAUTH-WG] draft-richer-oauth-introspection-03

From: Todd W Lainhart <[email-masked]>
Date: Thu, 7 Mar 2013 10:15:46 -0500

Hi Justin -

I'm comparing:

http://tools.ietf.org/html/draft-richer-oauth-introspection-03

...with:

http://tools.ietf.org/html/draft-ietf-oauth-revocation-05

for symmetry.

If that's appropriate, and if I use revocation as the baseline, I'm 
wondering why introspection supports GET in addition to POST, and doesn't 
require TLS (i.e. revocation only supports POST, and requires TLS).

Todd Lainhart
Rational software
IBM Corporation
550 King Street, Littleton, MA 01460-1250
1-978-899-4705
2-276-4705 (T/L)
[email-masked]

---

From: Todd W Lainhart <[email-masked]>
Date: Thu, 7 Mar 2013 10:23:29 -0500

I forgot to include the "token_type_hint" parameter in the baseline 
compare (i.e. revocation includes it as optional, introspection does not).

Todd Lainhart
Rational software
IBM Corporation

From:   Todd W Lainhart/Lexington/IBM@IBMUS
To:     "IETF oauth WG" <[email-masked]>, 
Date:   03/07/2013 10:17 AM
Subject:        [OAUTH-WG] draft-richer-oauth-introspection-03
Sent by:        [email-masked]

Hi Justin - 

I'm comparing: 

...with: 

for symmetry. 

Todd Lainhart
Rational software
IBM Corporation
550 King Street, Littleton, MA 01460-1250
1-978-899-4705
2-276-4705 (T/L)
[email-masked]
_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Justin Richer <[email-masked]>
Date: Thu, 7 Mar 2013 11:21:39 -0500

I hadn't set out to make the introspection draft parallel to the 
revocation draft, but I see no reason that these two items couldn't be 
incorporated with the same language and semantics.

  -- Justin

On 03/07/2013 10:23 AM, Todd W Lainhart wrote:
> *
> 550 King Street, Littleton, MA 01460-1250**
> 1-978-899-4705
> 2-276-4705 (T/L)
> [email-masked]*
>
>
>
>
>
>
> ------------------------------------------------------------------------
>
>
>
> Hi Justin -
>
> I'm comparing:
> _
> __http://tools.ietf.org/html/draft-richer-oauth-introspection-03_
>
> ...with:
> _
> __http://tools.ietf.org/html/draft-ietf-oauth-revocation-05_
>
> for symmetry.
>
> wondering why introspection supports GET in addition to POST, and 
> doesn't require TLS (i.e. revocation only supports POST, and requires 
> TLS).
> *
>
>
> Todd Lainhart
> Rational software
> IBM Corporation
> 550 King Street, Littleton, MA 01460-1250**
> 1-978-899-4705
> 2-276-4705 (T/L)
> [email-masked]*
>
>

---

From: Todd W Lainhart <[email-masked]>
Date: Thu, 7 Mar 2013 13:38:34 -0500

> ...but I see no reason that these two items couldn't be incorporated 
with the same language and semantics.

That's great.  "token_type_hint" is something that could be helpful to 
implementations.

Todd Lainhart
Rational software
IBM Corporation

From:   Justin Richer <[email-masked]>
To:     Todd W Lainhart/Lexington/IBM@IBMUS, 
Cc:     IETF oauth WG <[email-masked]>
Date:   03/07/2013 11:28 AM
Subject:        Re: [OAUTH-WG] draft-richer-oauth-introspection-03

 -- Justin

Todd Lainhart
Rational software
IBM Corporation

Hi Justin - 

I'm comparing: 

...with: 

for symmetry. 

Todd Lainhart
Rational software
IBM Corporation