Subject: [OAUTH-WG] Dynamic Registration and Resource API Targeting

From: Phil Hunt <[email-masked]>
Date: Tue, 4 Jun 2013 16:11:00 -0700 (PDT)

How is targeting achieved in dynamic registration? Or in other words how do we know what API is referred to within the scope?  Is the registration endpoint generic or to be matched with each resource API?

For example, in google's manual registration system, they ask which APIs the clients will access. This keeps scope from getting complex later on.

I'm worried about attempting to overload scope for this purpose during registration.

I suppose if a client can only register for one API at a time, then the usual OAuth2 techniques for targeting would apply.

Phil

@independentid
www.independentid.com
[email-masked]

---

From: John Bradley <[email-masked]>
Date: Wed, 5 Jun 2013 09:58:13 +0200

We are not changing current OAuth Semantics.   Scopes are per AS and might apply to different API.   The AS needs to sort out its scope name collision policy otherwise it will be a problem at the authorization endpoint when they request scopes anyway.     Scope is unfortunately already overloaded, we are supporting the overloaded scopes from the Authorization endpoint.

The AS could also have different registration endpoints for different API if they want to have separate client_id for the API. (the authorization and token endpoints could resolve scope name collisions based on client_id, but that is more an implementation issue they would logically be separate AS from the client perspective.)

The scopes are the ones used at the authorization/token endpoint. 

John B.

On 2013-06-05, at 1:11 AM, Phil Hunt <[email-masked]> wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth