Subject: [OAUTH-WG] IANA registry for error codes of RFC6749 section 5.2?

From: Ludwig Seitz <[email-masked]>
Date: Thu, 10 Oct 2019 11:15:16 +0200

Hello OAuth WG,

while addressing some AD review comments on draft-ietf-ace-oauth-authz, 
I've come across a question I think you can help me with:

I was previously laboring under the misconception that the error codes 
defined in

https://tools.ietf.org/html/rfc6749#section-5.2

are registered here:

https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#extensions-error

Which is apparently not the case. Is there another registry that one 
should use (e.g. if one needs to add new error codes)?

If there is none (which seems to be the case), should we create one?

Regards,

Ludwig

-- 
Ludwig Seitz, PhD
Security Lab, RISE
Phone +46(0)70-349 92 51

---

From: Justin Richer <[email-masked]>
Date: Thu, 10 Oct 2019 15:02:28 +0000

They are in that registry as the “token endpoint response” error codes. RFC8628 adds new ones.

I think that 6749 failed to put in the base ones.

— Justin

On Oct 10, 2019, at 5:15 AM, Ludwig Seitz <[email-masked]<mailto:[email-masked]>> wrote:

Hello OAuth WG,

while addressing some AD review comments on draft-ietf-ace-oauth-authz, I've come across a question I think you can help me with:

I was previously laboring under the misconception that the error codes defined in

are registered here:

Which is apparently not the case. Is there another registry that one should use (e.g. if one needs to add new error codes)?

Regards,

Ludwig

--
Ludwig Seitz, PhD
Security Lab, RISE
Phone +46(0)70-349 92 51

_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Ludwig Seitz <[email-masked]>
Date: Fri, 11 Oct 2019 08:17:07 +0200

> I think that 6749 failed to put in the base ones.

That would explain my confusion.

Errata-worthy?

/Ludwig

-- 
Ludwig Seitz, PhD
Security Lab, RISE
Phone +46(0)70-349 92 51

---

From: Benjamin Kaduk <[email-masked]>
Date: Sun, 13 Oct 2019 20:58:32 -0700

> That would explain my confusion.

I think it's not strictly necessary; we can just register the values using
the Specification Required procedure (I sent mail to kick things off
already:
https://mailarchive.ietf.org/arch/msg/oauth-ext-review/4WaM6n6JetFsLI6_T9S8wNVqP74

-Ben