Subject: [OAUTH-WG] New Token Introspection Draft

From: Justin Richer <[email-masked]>
Date: Thu, 3 Jul 2014 20:10:10 -0400

I’ve updated the token introspection draft with the intention that this document become input for a new working group item.

http://tools.ietf.org/html/draft-richer-oauth-introspection-05

The changes are mostly minimal edits to the text and a few reference fixes. One bigger change is the addition of the “user_id” field in addition to the “sub” field, as I’ve been asked by some users to add that feature to our own implementation here.

 — Justin

---

From: Thomas Broyer <[email-masked]>
Date: Fri, 4 Jul 2014 07:42:28 +0200

I thought someone mentioned it already: in the example you might want to
send the request to /introspect instead of /register. It would be good to
see user_id returned in the example too to get a better sense of what it
really means (as I understand it, it's the username the user uses to sign
in along with his password)
Le 4 juil. 2014 02:10, "Justin Richer" <[email-masked]> a écrit :

> I’ve updated the token introspection draft with the intention that this
> document become input for a new working group item.
>
> The changes are mostly minimal edits to the text and a few reference
> fixes. One bigger change is the addition of the “user_id” field in addition
> to the “sub” field, as I’ve been asked by some users to add that feature to
> our own implementation here.
>
>  — Justin
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: Nat Sakimura <[email-masked]>
Date: Fri, 4 Jul 2014 19:15:23 +0900

Thanks Justin. 

Is there any reason that there is no iss claim returned? 

=nat via iPhone

> On Jul 4, 2014, at 9:10, Justin Richer <[email-masked]> wrote:
> 
> ― Justin

---

From: Justin Richer <[email-masked]>
Date: Fri, 04 Jul 2014 07:45:55 -0400

Argh, good catch. Not sure how I missed that one again. At least it's 
not telling you to revoke tokens anymore. :)

Also, good call on the user_id in the example.

Thanks,
  -- Justin

On 7/4/2014 1:42 AM, Thomas Broyer wrote:
>
> I thought someone mentioned it already: in the example you might want 
> to send the request to /introspect instead of /register. It would be 
> good to see user_id returned in the example too to get a better sense 
> of what it really means (as I understand it, it's the username the 
> user uses to sign in along with his password)
>
> Le 4 juil. 2014 02:10, "Justin Richer" <[email-masked] 
> <mailto:[email-masked]>> a écrit :
>
>     I’ve updated the token introspection draft with the intention that
>     this document become input for a new working group item.
>
>     The changes are mostly minimal edits to the text and a few
>     reference fixes. One bigger change is the addition of the
>     “user_id” field in addition to the “sub” field, as I’ve been asked
>     by some users to add that feature to our own implementation here.
>
>      — Justin
>
>     [email-masked] <mailto:[email-masked]>