Subject: [OAUTH-WG] Section 4.3. Resource Owner Password Credentials: Invalid Credentials Error Handling

From: Colm Divilly <[email-masked]>
Date: Tue, 13 Sep 2011 09:07:31 -0700

Apologies if this has been covered before, a cursory search of the 
archives and issue tracker didn't turn up anything.

What is the expected error response when performing a Resource Owner 
Password Credentials flow, if the resource owner provides incorrect 
credentials?

 From reading the spec it looks like the expectation is that a response 
like the following should be generated:

      HTTP/1.1 400 Bad Request
      Content-Type: application/json;charset=UTF-8
      Cache-Control: no-store
      Pragma: no-cache

      {
        "error":"invalid_request"
      }

Which is not terribly helpful for a user-agent trying to determine that 
it is the user supplied credentials at fault (and therefore be able to 
re-prompt the user for credentials). Perhaps something like the 
following would be more useful:

      HTTP/1.1 400 Bad Request
      Content-Type: application/json;charset=UTF-8
      Cache-Control: no-store
      Pragma: no-cache

      {
        "error":"invalid_resource_owner_credentials"
      }

A bit verbose perhaps, any alternative suggestions?

Regards,
Colm Divilly

---

From: Brian Campbell <[email-masked]>
Date: Mon, 19 Sep 2011 14:30:51 -0600

The error should be invalid_grant as it is the grant (the resource
owner's username and password) that is invalid.

On Tue, Sep 13, 2011 at 10:07 AM, Colm Divilly <[email-masked]> wrote:
> Apologies if this has been covered before, a cursory search of the archives
> and issue tracker didn't turn up anything.
>
> From reading the spec it looks like the expectation is that a response like
> the following should be generated:
>
>     HTTP/1.1 400 Bad Request
> Which is not terribly helpful for a user-agent trying to determine that it
> is the user supplied credentials at fault (and therefore be able to
> re-prompt the user for credentials). Perhaps something like the following
> would be more useful:
>
>     HTTP/1.1 400 Bad Request
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 20 Sep 2011 12:35:30 -0700

'invalid_grant'. Added (e.g.) to the error code to make it more explicit.

EHL

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Colm Divilly
> Sent: Tuesday, September 13, 2011 9:08 AM
> To: [email-masked]
> Subject: [OAUTH-WG] Section 4.3. Resource Owner Password Credentials:
> Invalid Credentials Error Handling
> 
>  From reading the spec it looks like the expectation is that a response like the
> following should be generated:
> 
>       HTTP/1.1 400 Bad Request
> Which is not terribly helpful for a user-agent trying to determine that it is the
> user supplied credentials at fault (and therefore be able to re-prompt the
> user for credentials). Perhaps something like the following would be more
> useful:
> 
>       HTTP/1.1 400 Bad Request