Subject: Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-dyn-reg-12.txt

From: "Vladimir Dzhuvinov / NimbusDS" <[email-masked]>
Date: Fri, 21 Jun 2013 23:54:27 -0700

Hi Justin,

Thanks for continuing work on this important draft. I started
implementing the new version into the Nimbus SDK and noticed a few
problems in section 5.2 regarding the expected error response codes:

http://tools.ietf.org/html/draft-ietf-oauth-dyn-reg-12#section-5.2

1. The first paragraph says that the error codes specified in section
5.2 of OAuth 2.0 (RFC 6749) may be used in registration error responses,
however, I cannot see any particular error code that could apply to
registration, perhaps only "invalid_request" (also, the link to the
OAuth 2.0 core spec seems to be incorrect).

2. Requests to the client configuration endpoint involve a protected
resource and require a bearer access token. How about including a
reference to the error codes from OAuth 2.0 Bearer Token Usage (RFC
6750) for that?

3. Finally, the statement that HTTP 400 is to be returned on a error
condition contradicts with other parts of the spec that require other
status codes.

Thanks,

Vladimir
--
Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]

---

From: Justin Richer <[email-masked]>
Date: Mon, 24 Jun 2013 09:44:42 -0400

The idea here is that if you're using an OAuth access token to access 
the registration endpoint or client configuration endpoint, and that 
token causes an error, then you ought to use the error codes associated 
with that method (ie, the ones defined by the token type). I think that 
this is pointing to the wrong list of errors -- it should probably be 
section 6.2 in RFC6750. My mistake, and I'll fix the reference once I 
make sure I've got it straight.

To address #3, would it be better to have "unless otherwise specified" 
in that text?

Thanks for your review.

  -- Justin

On 06/22/2013 02:54 AM, Vladimir Dzhuvinov / NimbusDS wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Vladimir Dzhuvinov / NimbusDS <[email-masked]>
Date: Wed, 26 Jun 2013 18:40:48 +0300

> To address #3, would it be better to have "unless otherwise specified" 

How about the following:

"""
If the client presents an invalid Registration Access Token, the
Authorization Server returns an Error Response that is appropriate for
the token type ( http://tools.ietf.org/html/rfc6749#section-7.2 )
"""

My reasoning is that if we consider the registration request, the only
thing that is OAuth 2.0 (RFC 6749) specific about it is the optional
presence of an access token to authorise the registration. Since the
access token type is not specified, then we ought to say the possible
errors depend on the token type (and Bearer is just one instance of a
token type, so perhaps we shouldn't mention RFC 6750).

Hope this helped,

Vladimir

---

From: Vladimir Dzhuvinov / NimbusDS <[email-masked]>
Date: Fri, 28 Jun 2013 11:21:30 +0300

A server that implements dynamic registration must support all three
requests - register, update and delete, is that correct?

I had another careful read of the spec and I think it would help to
mention this explicitly.

Cheers,

Vladimir

---

From: Justin Richer <[email-masked]>
Date: Fri, 28 Jun 2013 09:25:04 -0400

A server is supposed to at least listen for all actions and return the 
right error codes if it can't (or won't) complete the request. For 
instance, a 403 from the update action means the client isn't allowed to 
update its record. A 405 from the delete action means the server can't 
support the action at all, and a 403 from the delete means that the 
server supports the action but the client isn't allowed to delete its 
own record. You can get at that information by reading through each of 
the sections in (4), but if you can suggest text for the introductory 
section of (4) that would help clarify this situation, I'd appreciate it.

Thanks,

  -- Justin