Subject: Re: [OAUTH-WG] Resource Owner Password Credential error response question

From: Antonio Sanso <[email-masked]>
Date: Mon, 3 Feb 2014 09:21:00 +0000

On Jan 28, 2014, at 5:08 PM, George Fletcher <[email-masked]<mailto:[email-masked]>> wrote:

I have a situation where some "trusted" clients would like to use the ROPC flow. However, there are a number of external circumstances that can block the request even though the user's credentials are actually valid. Basically, from a back-end perspective we want to force the user through a web flow. I looked through the list of error responses and none seem to fit. 'invalid_grant' is the closest but that wouldn't give the client any indication that the user might be able to successfully complete the authorization flow if the client sends the user through a web flow instead of the ROPC flow.

Now I know one answer... which is... to just always use the web flow :)

+1, :) why can’t you use this in your case?

regards

antonio

Has any one else run into this? Do I register a new error response via Section 11.4? In looking at the template it doesn't appear possible to add error responses to an existing flow.

Does that mean I'd need to create an extension grant that is basically the same as the ROPC but because it's an extension now can have additional error responses?

Best practice guidance greatly appreciated! :)

Thanks,
George

--
<Mail Attachment.png><http://connect.me/gffletch>
_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth