Subject: [OAUTH-WG] Can i use domain name for oauth2 client id?

From: Viruthagiri Thirumavalavan <[email-masked]>
Date: Mon, 29 Aug 2016 03:21:07 +0530

I'm working on a OAuth2 server project. Can I use domain name for
generating client_id ?

Ex: For instance if Google registering an app in my server, then the
client_id will be google.com

Am i allowed to use dots in client_id? Is it wise to use domain name as
client_id ? what are the drawbacks?
Thanks
-- 
Regards,
Giri

---

From: Justin Richer <[email-masked]>
Date: Mon, 29 Aug 2016 18:56:51 +0300

Dots are legal in a client ID (as per the spec), and there’s nothing inherently wrong with a client ID that’s a domain name. However, how can you be sure it’s google that gets the client ID “google.com <http://google.com/>”? And what if Google wants to have two clients?

In many implementations (including ours from MIT ITC), the client ID is random (we use a type 4 UUID) and we’ve got a separate field for human-readable names (client_name, defined in the dynamic registration specification).

 — Justin

> On Aug 29, 2016, at 12:51 AM, Viruthagiri Thirumavalavan <[email-masked]> wrote:
> 
> I'm working on a OAuth2 server project. Can I use domain name for generating client_id ?
> 
> Ex: For instance if Google registering an app in my server, then the client_id will be google.com <http://google.com/>
> Am i allowed to use dots in client_id? Is it wise to use domain name as client_id ? what are the drawbacks?
> 
> Thanks
> -- 
> Regards,
> Giri
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Viruthagiri Thirumavalavan <[email-masked]>
Date: Mon, 29 Aug 2016 22:25:15 +0530

Thanks Justin.

I just need a way to identify client_id. I'm planning to use 15 char for
client_id. Can I use first 3 char of domain and then random number for
client ID for the rest 12 char?

I mean something like GOO123456789123 for Google.

Thanks

On Mon, Aug 29, 2016 at 9:26 PM, Justin Richer <[email-masked]> wrote:

> Dots are legal in a client ID (as per the spec), and there’s nothing
> inherently wrong with a client ID that’s a domain name. However, how can
> you be sure it’s google that gets the client ID “google.com”? And what if
> Google wants to have two clients?
>
> In many implementations (including ours from MIT ITC), the client ID is
> random (we use a type 4 UUID) and we’ve got a separate field for
> human-readable names (client_name, defined in the dynamic registration
> specification).
>
>  — Justin
>

-- 
Regards,
Giri