Subject: [OAUTH-WG] Unclear parts in OAuth 2.0 specification

From: Martin Ždila <[email-masked]>
Date: Fri, 30 Aug 2013 09:41:17 +0200

Hello

There are some unclear parts in OAuth 2.0 specification.

*1.* In 4.3. (B) there is following statement:

   When making the request, the client
   authenticates with the authorization server.

In 4.3.2 there is following statement:

   If the client type is confidential or the client was issued client
   credentials (or assigned other authentication requirements), the
   client MUST authenticate with the authorization server as described
   in Section 3.2.1 <http://tools.ietf.org/html/rfc6749#section-3.2.1>.

First statement states that client credentials must be always passed.
Second states that it is required only for certain client types.

Also, if client type doesn't provide credentials, there is no mean to
identify it and so impossible to check if client credentials were actually
required.

*2.* Authorization Code Grant and Implicit Grant use different URL part to
encode its response. Former uses query and later fragment. If request has
invalid or is missing response_type parameter then user agent should be
redirected to URL with error response where
error=unsupported_response_type. But if we don't know what type of grant we
are handling, where to put error parameters? To query or fragment part of
the URL?

Please clarify that.

Thanks in advance

Best regards

-- 
Ing. Martin Ždila
Senior Analyst / Developer

M-Way Solutions Slovakia s.r.o.
Letná 27, 040 01 Košice
Slovakia

tel:+421-908-363-848
mailto:[email-masked]
http://www.mwaysolutions.com

---

From: Dick Hardt <[email-masked]>
Date: Fri, 30 Aug 2013 15:53:13 +0800

> identify it and so impossible to check if client credentials were actually

I'm sorry the spec was not clear to you when you read it. Unfortunately,
 your question is not clear to me, so I don't know how to answer it.

>
> *2.* Authorization Code Grant and Implicit Grant use different URL part
> to encode its response. Former uses query and later fragment. If request
> has invalid or is missing response_type parameter then user agent should be
The grant type is a parameter in the request, so the authorization server
knows the request type from that and hence how to respond.

---

From: Todd W Lainhart <[email-masked]>
Date: Fri, 30 Aug 2013 08:34:27 -0400

Think that there are three different types of clients: confidential; 
public; and anonymous (my term).

Confidential: id and secret;
Public: id only;
Anonymous: no credentials;

You provide the type of credentials that you can, and the protected 
endpoint will accept or reject based on the operation and its protections.

Todd Lainhart
Rational software
IBM Corporation
550 King Street, Littleton, MA 01460-1250
1-978-899-4705
2-276-4705 (T/L)
[email-masked]

From:   Martin Ždila <[email-masked]>
To:     [email-masked], 
Date:   08/30/2013 03:42 AM
Subject:        [OAUTH-WG] Unclear parts in OAuth 2.0 specification
Sent by:        [email-masked]

Hello

1. In 4.3. (B) there is following statement:
   When making the request, the client
   authenticates with the authorization server.

   in Section 3.2.1.

2. Authorization Code Grant and Implicit Grant use different URL part to 
encode its response. Former uses query and later fragment. If request has 
invalid or is missing response_type parameter then user agent should be 
redirected to URL with error response where 
error=unsupported_response_type. But if we don't know what type of grant 
we are handling, where to put error parameters? To query or fragment part 
of the URL?

Please clarify that.

Thanks in advance

Best regards

tel:+421-908-363-848
mailto:[email-masked]
http://www.mwaysolutions.com 
_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth