Subject: Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-dyn-reg-12.txt

From: "Vladimir Dzhuvinov / NimbusDS" <[email-masked]>
Date: Mon, 17 Jun 2013 22:26:35 -0700

Hi Justin,

Thanks for continuing work on this important draft. I started
implementing the new version into the Nimbus SDK and noticed a few
problems in section 5.2 regarding the expected error response codes:

http://tools.ietf.org/html/draft-ietf-oauth-dyn-reg-12#section-5.2

1. The first paragraph says that the error codes specified in section
5.2 of OAuth 2.0 (RFC 6749) may be used in registration error responses,
however, I cannot see any particular error code that could apply to
registration, perhaps only "invalid_request" (also, the link to the
OAuth 2.0 core spec seems to be incorrect).

2. Requests to the client configuration endpoint involve a protected
resource and require a bearer access token. How about including a
reference to the error codes from OAuth 2.0 Bearer Token Usage (RFC
6750) for that?

3. Finally, the statement that HTTP 400 is to be returned on a error
condition contradicts with other parts of the spec that require other
status codes.

Thanks,

Vladimir
--
Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]