Subject: [OAUTH-WG] Initial OAuth working group Device Flow specification

From: Mike Jones <[email-masked]>
Date: Thu, 18 Feb 2016 08:34:54 +0000

Thanks to William Denniss for creating the initial working group version of the OAuth 2.0 Device Flow specification.  The abstract of the specification is:

The device flow is suitable for OAuth 2.0 clients executing on devices which do not have an easy data-entry method (e.g., game consoles, TVs, picture frames, and media hubs), but where the end-user has separate access to a user-agent on another computer or device (e.g., desktop computer, a laptop, a smart phone, or a tablet).

Note: This version of the document is a continuation of an earlier, long expired draft.  The content of the expired draft has been copied almost unmodified.  The goal of the work on this document is to capture deployment experience.

If you're using an OAuth device flow, please let us know whether this specification matches your usage, and if not, how yours differs.

The specification is available at:

*       http://tools.ietf.org/html/draft-ietf-oauth-device-flow-00

An HTML-formatted version is also available at:

*       http://self-issued.info/docs/draft-ietf-oauth-device-flow-00.html

                                                          -- Mike

P.S.  This notice was also posted at http://self-issued.info/?p=1546 and as @selfissued<https://twitter.com/selfissued>.

---

From: Aaron Parecki <[email-masked]>
Date: Thu, 18 Feb 2016 08:51:47 -0800

I had previously made some comments on this back in November, but never
heard any response. These were things I ran into while implementing the
device flow on one of my servers.

https://mailarchive.ietf.org/arch/msg/oauth/JzH-isRij9kCpbEJpXVqwZ6XjjU

https://mailarchive.ietf.org/arch/msg/oauth/XQJ4e_kgBOfn3tkTBXf6bYVNGJE

----
Aaron Parecki
aaronparecki.com
@aaronpk <http://twitter.com/aaronpk>

On Thu, Feb 18, 2016 at 12:34 AM, Mike Jones <[email-masked]>
wrote:

> Thanks to William Denniss for creating the initial working group version
> of the OAuth 2.0 Device Flow specification.  The abstract of the
> specification is:
>
>
>
> The device flow is suitable for OAuth 2.0 clients executing on devices
> which do not have an easy data-entry method (e.g., game consoles, TVs,
> picture frames, and media hubs), but where the end-user has separate access
> to a user-agent on another computer or device (e.g., desktop computer, a
> laptop, a smart phone, or a tablet).
>
>
>
> Note: This version of the document is a continuation of an earlier, long
> expired draft.  The content of the expired draft has been copied almost
> unmodified.  The goal of the work on this document is to capture deployment
> experience.
>
>
>
> If you’re using an OAuth device flow, please let us know whether this
> specification matches your usage, and if not, how yours differs.
>
>
>
> ·       http://tools.ietf.org/html/draft-ietf-oauth-device-flow-00
>
>
>
> ·       http://self-issued.info/docs/draft-ietf-oauth-device-flow-00.html
>
>
>
>                                                           -- Mike
>
>
>
> P.S.  This notice was also posted at http://self-issued.info/?p=1546 and
> as @selfissued <https://twitter.com/selfissued>.
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: William Denniss <[email-masked]>
Date: Thu, 18 Feb 2016 09:28:52 -0800

Thanks for your feedback, you make some very good points.

Currently this draft was just resurrecting the previous draft and we've yet
to do a pass on it yet based on our actual implementation experience.  I'll
make sure to address your points when we do.

I agree that entering the code is NOT equivalent to granting authorization!
That's not how we implemented it.