Subject: [OAUTH-WG] Advertise PKCE support in OAuth 2.0 Discovery (draft-jones-oauth-discovery-00)

From: Vladimir Dzhuvinov <[email-masked]>
Date: Wed, 6 Jan 2016 16:29:49 +0200

I just noticed PKCE support is missing from the discovery metadata.

Is it a good idea to add it?

Cheers,

Vladimir

-- 
Vladimir Dzhuvinov

---

From: John Bradley <[email-masked]>
Date: Wed, 6 Jan 2016 09:40:34 -0500

Good point.  Now that PKCE is a RFC we should add it to discovery.

John B.
> On Jan 6, 2016, at 9:29 AM, Vladimir Dzhuvinov <[email-masked]> wrote:
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: William Denniss <[email-masked]>
Date: Wed, 6 Jan 2016 09:25:23 -0800

+1

---

From: Torsten Lodderstedt <[email-masked]>
Date: Wed, 6 Jan 2016 18:59:44 +0100

+1

Am 06.01.2016 um 18:25 schrieb William Denniss:
> +1
>
> On Wed, Jan 6, 2016 at 6:40 AM, John Bradley <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     > On Jan 6, 2016, at 9:29 AM, Vladimir Dzhuvinov
>     <[email-masked] <mailto:[email-masked]>> wrote:
>     >
>     > [email-masked] <mailto:[email-masked]>
>     [email-masked] <mailto:[email-masked]>

---

From: William Denniss <[email-masked]>
Date: Mon, 18 Jan 2016 18:58:37 -0800

Seems like we agree this should be added. How should it look?

Two ideas:

"code_challenge_methods_supported": ["plain", "S256"]

or

"pkce_methods_supported": ["plain", "S256"]

On Wed, Jan 6, 2016 at 9:59 AM, Torsten Lodderstedt <[email-masked]
> wrote:

> OAuth mailing [email-masked]://www.ietf.org/mailman/listinfo/oauth
>
>
>

---

From: Nat Sakimura <[email-masked]>
Date: Wed, 20 Jan 2016 23:47:56 +0000

I kind of prefer pkce_methods_supported as it scopes it more narrowly and
less likely to be overloaded.
2016年1月19日(火) 11:59 William Denniss <[email-masked]>:

> On Wed, Jan 6, 2016 at 9:59 AM, Torsten Lodderstedt <
> [email-masked]> wrote:
>
>> +1
>>
>>

---

From: nov matake <[email-masked]>
Date: Thu, 21 Jan 2016 09:31:03 +0900

I prefer “code_challenge_methods_supported”, since the registered parameter name is “code_challenge_method”, not “pkce_method".

> On Jan 19, 2016, at 11:58, William Denniss <[email-masked]> wrote:
> 
> On Wed, Jan 6, 2016 at 9:59 AM, Torsten Lodderstedt <[email-masked] <mailto:[email-masked]>> wrote:
> +1
> 
> 
>> On Wed, Jan 6, 2016 at 6:40 AM, John Bradley <[email-masked] <mailto:[email-masked]>> wrote:
>> > On Jan 6, 2016, at 9:29 AM, Vladimir Dzhuvinov <[email-masked] <mailto:[email-masked]>> wrote:
>> >
>> > https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>
>> 
>> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>
>> 
>> 
>> 
>> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>
> 
>

---

From: Nat Sakimura <[email-masked]>
Date: Thu, 21 Jan 2016 05:37:59 +0000

Ah, OK. That's actually reasonable.

2016年1月21日(木) 9:31 nov matake <[email-masked]>:

> I prefer “code_challenge_methods_supported”, since the registered
> parameter name is “code_challenge_method”, not “pkce_method".
>

---

From: William Denniss <[email-masked]>
Date: Thu, 21 Jan 2016 14:12:42 +0800

"code_challenge_methods_supported" definitely works for me.

Any objections to moving forward with that? I would like to update our
discovery doc shortly.

---

From: John Bradley <[email-masked]>
Date: Thu, 21 Jan 2016 11:17:41 -0300

The code_challenge and code_challenge_method parameter names predate calling the spec PKCE.  

Given that some of us deployed early versions of PKCE in products and opensource to mitigate the problem before the spec was completed we decided not to rename the parameter names from code_verifier_method to pkce_verifier_method.  

For consistency we should stick with code_verifier_methods_supported in discovery.

John B.

> On Jan 21, 2016, at 3:12 AM, William Denniss <[email-masked]> wrote:
> 
> Any objections to moving forward with that? I would like to update our discovery doc shortly.
> 
> On Thu, Jan 21, 2016 at 1:37 PM, Nat Sakimura <[email-masked] <mailto:[email-masked]>> wrote:
> 2016年1月21日(木) 9:31 nov matake <[email-masked] <mailto:[email-masked]>>:
>> On Jan 19, 2016, at 11:58, William Denniss <[email-masked] <mailto:[email-masked]>> wrote:
>>

---

From: Nat Sakimura <[email-masked]>
Date: Thu, 21 Jan 2016 14:26:08 +0000

+1. Even as the main editor of the spec., I tend to forget the history ;-)

2016年1月21日(木) 23:17 John Bradley <[email-masked]>:

> Given that some of us deployed early versions of PKCE in products and
> opensource to mitigate the problem before the spec was completed we decided
> not to rename the parameter names from code_verifier_method to
> pkce_verifier_method.
>

---

From: Phil Hunt <[email-masked]>
Date: Mon, 25 Jan 2016 10:33:58 -0800

+1

Phil

@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

> On Jan 21, 2016, at 6:26 AM, Nat Sakimura <[email-masked]> wrote:
> 
> 2016年1月21日(木) 23:17 John Bradley <[email-masked] <mailto:[email-masked]>>:
>> On Jan 21, 2016, at 3:12 AM, William Denniss <[email-masked] <mailto:[email-masked]>> wrote:
>>

---

From: William Denniss <[email-masked]>
Date: Mon, 25 Jan 2016 13:12:04 -0800

> For consistency we should stick with code_verifier_methods_supported in

To clarify, did you mean "code_challenge_methods_supported"?  That is,
building on the param name "code_challenge_method" from Section 4.3
<https://tools.ietf.org/html/rfc7636#section-4.3>?

---

From: John Bradley <[email-masked]>
Date: Mon, 25 Jan 2016 19:11:17 -0300

Yes sorry.   code_challenge_method is the query parameter so code_challenge_methods_supported

> On Jan 25, 2016, at 6:12 PM, William Denniss <[email-masked]> wrote:
> 
> 
> 
> On Thu, Jan 21, 2016 at 6:17 AM, John Bradley <[email-masked] <mailto:[email-masked]>> wrote:
> To clarify, did you mean "code_challenge_methods_supported"?  That is, building on the param name "code_challenge_method" from Section 4.3 <https://tools.ietf.org/html/rfc7636#section-4.3>?
>  
> 
> John B.
>

---

From: William Denniss <[email-masked]>
Date: Mon, 25 Jan 2016 14:29:19 -0800

OK great! It seems that we have consensus on this. So this is what we plan
to add to our discovery doc, based on this discussion:

"code_challenge_methods_supported": ["plain","S256"]

What are the next steps? Can we we add it to
https://tools.ietf.org/html/draft-jones-oauth-discovery directly? I see
that the IANA registry created by that draft is "Specification Required",
but PKCE is already an RFC without this param being registered.

---

From: Mike Jones <[email-masked]>
Date: Mon, 25 Jan 2016 22:49:18 +0000

I'll add it to the discovery draft in the next day or so.  Also, please see my questions in the message "[OAUTH-WG] Discovery document updates planned". I was waiting for that feedback before doing the update.

Thanks,
-- Mike
________________________________
From: William Denniss<mailto:[email-masked]>
Sent: ‎1/‎25/‎2016 2:29 PM
To: John Bradley<mailto:[email-masked]>
Cc: Nat Sakimura<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; Mike Jones<mailto:[email-masked]>
Subject: Re: [OAUTH-WG] Advertise PKCE support in OAuth 2.0 Discovery (draft-jones-oauth-discovery-00)

OK great! It seems that we have consensus on this. So this is what we plan to add to our discovery doc, based on this discussion:

What are the next steps? Can we we add it to https://tools.ietf.org/html/draft-jones-oauth-discovery directly? I see that the IANA registry created by that draft is "Specification Required", but PKCE is already an RFC without this param being registered.

On Mon, Jan 25, 2016 at 2:11 PM, John Bradley <[email-masked]<mailto:[email-masked]>> wrote:
Yes sorry.   code_challenge_method is the query parameter so code_challenge_methods_supported

On Jan 25, 2016, at 6:12 PM, William Denniss <[email-masked]<mailto:[email-masked]>> wrote:

On Thu, Jan 21, 2016 at 6:17 AM, John Bradley <[email-masked]<mailto:[email-masked]>> wrote:
The code_challenge and code_challenge_method parameter names predate calling the spec PKCE.

To clarify, did you mean "code_challenge_methods_supported"?  That is, building on the param name "code_challenge_method" from Section 4.3<https://tools.ietf.org/html/rfc7636#section-4.3>?

John B.

On Jan 21, 2016, at 3:12 AM, William Denniss <[email-masked]<mailto:[email-masked]>> wrote:

On Thu, Jan 21, 2016 at 1:37 PM, Nat Sakimura <[email-masked]<mailto:[email-masked]>> wrote:
Ah, OK. That's actually reasonable.

2016?1?21?(?) 9:31 nov matake <[email-masked]<mailto:[email-masked]>>:
I prefer “code_challenge_methods_supported”, since the registered parameter name is “code_challenge_method”, not “pkce_method".

On Jan 19, 2016, at 11:58, William Denniss <[email-masked]<mailto:[email-masked]>> wrote:

Two ideas:

or

On Wed, Jan 6, 2016 at 9:59 AM, Torsten Lodderstedt <[email-masked]<mailto:[email-masked]>> wrote:
+1

On Wed, Jan 6, 2016 at 6:40 AM, John Bradley <[email-masked]<mailto:[email-masked]>> wrote:
Good point.  Now that PKCE is a RFC we should add it to discovery.

John B.
> On Jan 6, 2016, at 9:29 AM, Vladimir Dzhuvinov <[email-masked]<mailto:[email-masked]>> wrote:
>
> [email-masked]<mailto:[email-masked]>

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: William Denniss <[email-masked]>
Date: Mon, 25 Jan 2016 16:08:36 -0800

Thanks Mike, looking forward to the update. I reviewed the other thread.

On Mon, Jan 25, 2016 at 2:49 PM, Mike Jones <[email-masked]>
wrote:

> I'll add it to the discovery draft in the next day or so.  Also, please
> see my questions in the message "[OAUTH-WG] Discovery document updates
> planned". I was waiting for that feedback before doing the update.
>
> Thanks,
> -- Mike
> ------------------------------
> From: William Denniss <[email-masked]>
> To: John Bradley <[email-masked]>
> Cc: Nat Sakimura <[email-masked]>; [email-masked]; Mike Jones
> <[email-masked]>