Subject: [OAUTH-WG] Bearer token credentials syntax

From: Mike Jones <[email-masked]>
Date: Fri, 23 Sep 2011 14:00:27 +0000

James Manger and others pointed out that the current credentials syntax does not comply with RFC 2617, nor does it match the updated credentials syntax contained in HTTPbis, part 7: Authentication<http://tools.ietf.org/html/draft-ietf-httpbis-p7-auth-16>.  The current syntax in the bearer token draft<http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-08> is:
   credentials     = "Bearer" RWS access-token
   access-token    = 1*( quoted-char / <"> )

   quoted-char     = ALPHA / DIGIT /
                     "!" / "#" / "$" / "%" / "&" / "'" / "(" / ")" /
                     "*" / "+" / "-" / "." / "/" / ":" / "<" / "=" /
                     ">" / "?" / "@" / "[" / "]" / "^" / "_" / "`" /
                     "{" / "|" / "}" / "~" / "\" / "," / ";"

The syntax in HTTPbis is:
    credentials = auth-scheme [ 1*SP ( b64token / #auth-param ) ]

(Note that some of the BNF elements used by part 7 are defined in HTTPbis, part 1: Messaging<http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging-16>.)

To resolve this comment, I plan to change the Bearer Token draft to use this syntax for credentials, matching HTTPbis:
   credentials = "Bearer" 1*SP ( b64token / #auth-param )

Are people good with this approach?

                                                                Thanks,
                                                                -- Mike

---

From: Marius Scurtescu <[email-masked]>
Date: Fri, 23 Sep 2011 10:15:35 -0700

On Fri, Sep 23, 2011 at 7:00 AM, Mike Jones <[email-masked]> wrote:
> James Manger and others pointed out that the current credentials syntax does
> not comply with RFC 2617, nor does it match the updated credentials syntax
> contained in HTTPbis, part 7: Authentication.  The current syntax in the
> bearer token draft is:
>
> (Note that some of the BNF elements used by part 7 are defined in HTTPbis,
> part 1: Messaging.)
>
>
>
> To resolve this comment, I plan to change the Bearer Token draft to use this
> syntax for credentials, matching HTTPbis:
>

+1

---

From: John Bradley <[email-masked]>
Date: Fri, 23 Sep 2011 14:22:50 -0300

+1

On 2011-09-23, at 11:00 AM, Mike Jones wrote:

> James Manger and others pointed out that the current credentials syntax does not comply with RFC 2617, nor does it match the updated credentials syntax contained in HTTPbis, part 7: Authentication.  The current syntax in the bearer token draft is:
> (Note that some of the BNF elements used by part 7 are defined in HTTPbis, part 1: Messaging.)
>  
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Phil Hunt <[email-masked]>
Date: Fri, 23 Sep 2011 11:35:20 -0700

+1

Phil

@independentid
www.independentid.com
[email-masked]

---

From: Dick Hardt <[email-masked]>
Date: Fri, 23 Sep 2011 14:05:54 -0700

+1.1

---

From: "Manger, James H" <[email-masked]>
Date: Sun, 25 Sep 2011 01:04:03 +1000

-1

   credentials = "Bearer" 1*SP b64token
would make sense.

   credentials = "Bearer" 1*SP ( b64token / #auth-param )
does not make sense as the spec doesn't define a way to carry the bearer token in the #auth-param choice.

--
James Manger

From: [email-masked] [mailto:[email-masked]] On Behalf Of Mike Jones
Sent: Saturday, 24 September 2011 12:00 AM
To: [email-masked]
Subject: [OAUTH-WG] Bearer token credentials syntax

                                                                Thanks,
                                                                -- Mike