Subject: [OAUTH-WG] Last call for feedback on -08

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 21 Jun 2010 19:27:03 -0700

I am working on -09 which I hope will be the last major revision of the specification. If you were planning on submitting any feedback on draft -08 or the simplification proposal from David and me, please do so by tomorrow to be included in the next draft.

EHL

---

From: Justin Richer <[email-masked]>
Date: Tue, 22 Jun 2010 09:24:00 -0400

> I am working on -09 which I hope will be the last major revision of
> the specification. If you were planning on submitting any feedback on
> draft -08 or the simplification proposal from David and me, please do
> so by tomorrow to be included in the next draft.

I am mostly looking for the extension mechanisms to be laid out. There
are four features that I'd like to see covered by OAuth as a whole:

 * Token Revocation
 * Redelegation
 * Client instance information (update of xoauth_display_name)
 * Handling of unregistered and dynamically-registered clients

Each of these could be handled by an extension and/or guideline doc, and
I'm willing to try my hand at writing some of these out. Any takers for
input into solutions for any of these problems?

I'm also interested to see what happens with the signing proposals,
because we still have use cases for the signed-fetch portion of OAuth 1
(both 2-legged and 3-legged). But I'll freely admit that I am not the
one to write this. :)

 -- Justin

---

From: Marius Scurtescu <[email-masked]>
Date: Tue, 22 Jun 2010 13:00:23 -0700

There was a suggestion to expand the 'error' parameter to two
different parameters:
- error_code - well defined list of error codes
- error_description - authz server specific free form error
description (for logging and troubleshooting)

Not sure if you considered this.

Marius

On Mon, Jun 21, 2010 at 7:27 PM, Eran Hammer-Lahav <[email-masked]> wrote:
> I am working on -09 which I hope will be the last major revision of the
> specification. If you were planning on submitting any feedback on draft -08
> or the simplification proposal from David and me, please do so by tomorrow
> to be included in the next draft.
>
>
>
> EHL
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 22 Jun 2010 13:05:52 -0700

There was also a suggestion by Brian to add an error_uri for additional information.

I'm happy to include all three.

EHL

> -----Original Message-----
> From: Marius Scurtescu [mailto:[email-masked]]
> Sent: Tuesday, June 22, 2010 1:00 PM
> To: Eran Hammer-Lahav
> Cc: OAuth WG ([email-masked])
> Subject: Re: [OAUTH-WG] Last call for feedback on -08
> 
> There was a suggestion to expand the 'error' parameter to two different
> parameters:
> - error_description - authz server specific free form error description (for
> logging and troubleshooting)
>

---

From: David Recordon <[email-masked]>
Date: Tue, 22 Jun 2010 13:46:31 -0700

If we have both error_code and error_description, why is an error_uri
needed? (I'm not finding anything when I search the list for
'error_uri'.)

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 22 Jun 2010 15:09:18 -0700

It was proposed as part of the device or username and password flow IIRC. Google has something like that when captcha breaks.

EHL

> From: David Recordon [mailto:[email-masked]]
> Sent: Tuesday, June 22, 2010 1:47 PM
> To: Eran Hammer-Lahav
> Cc: Marius Scurtescu; OAuth WG ([email-masked])
> >> different
> >> > the specification. If you were planning on submitting any feedback
> >> > on draft -08 or the simplification proposal from David and me,
> >> > please do so by tomorrow to be included in the next draft.
> >> >
> >> >
> >> >
> >> > EHL
> >> >

---

From: Marius Scurtescu <[email-masked]>
Date: Tue, 22 Jun 2010 18:00:19 -0700

> input into solutions for any of these problems?

I can help you with the last two. We should start separate threads to
tackle them.

Marius

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 22 Jun 2010 18:49:08 -0700

> >  * Handling of unregistered and dynamically-registered clients

My discovery draft covers that, but other are free to propose alternatives (before or after I publish my draft).

EHL

---

From: Brian Campbell <[email-masked]>
Date: Tue, 22 Jun 2010 21:00:35 -0600

Sounds like it's already in for -09 but I'd still like to voice my support
for some kind of optional parameter like error_description.

I'm working on a draft profiling a specific use of SAML in the assertion
grant_type flow (coming soon to this list I hope) and added in an
error_detail parameter for exactly the same purpose that Marius describes.
I'm sure it would be useful in many other contexts, however, and it'd be
good to have it in the core spec - giving the client side some ability to
troubleshoot without having to directly involve people on the authz server
side will be, IMHO, very valuable.

-Brian