Subject: [OAUTH-WG] Authorization Code Grant diagram Improvement OAuth 2.1 draft-ietf-oauth-v2-1

From: Warren Parad <[email-masked]>
Date: Thu, 30 Jul 2020 17:41:45 +0200

https://www.ietf.org/id/draft-ietf-oauth-v2-1-00.html#name-authorization-code-grant

Can we avoid using (1, 2, 3) on the left side of the diagram to describe,
I'm not even sure what they are supposed to represent, not to mention the
RO in the diagram doesn't really provide value (for me) relevant to the
code grant flow. It's confusing to see these numerical identifiers twice in
the same picture. But maybe there is something hidden in this that I'm
missing, still 3a and 3b could be used to identify different legs of the
same code path.

*Warren Parad*
Secure your user data and complete your authorization architecture.
Implement Authress <https://bit.ly/37SSO1p>.
<https://rhosys.ch>

---

From: Aaron Parecki <[email-masked]>
Date: Thu, 30 Jul 2020 08:49:17 -0700

These numbers in the diagram correspond to the numbered steps in the
paragraphs below the diagram. Perhaps using non-duplicated numbers would
help, such as "1a" and "1b" instead of two instances of "1"? Although I'm
not sure how that would work exactly because the "1/2/3" are really just a
single action as described by the "Note" below the diagram in your
screenshot.

---
Aaron Parecki
https://aaronparecki.com
https://oauth2simplified.com

On Thu, Jul 30, 2020 at 8:43 AM Warren Parad <[email-masked]> wrote:

> Implement Authress <https://bit..ly/37SSO1p>.
> <https://rhosys.ch>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Warren Parad <[email-masked]>
Date: Thu, 30 Jul 2020 18:57:29 +0200

>From the OAuth RFC, these were actually letters. I don't see a necessary
association between the left side of the diagram and the right side, it
just seems unnecessarily confusing.

Warren Parad

Founder, CTO

---

From: Dick Hardt <[email-masked]>
Date: Thu, 30 Jul 2020 10:23:26 -0700

The (A), (B), and (C) label the same flow that bounces through the
User-Agent. See note below the diagram.

Note the tails and arrows at each end of (A) and (C), and the arrows at
both ends of (B) to indicate an interaction between the RO and the AS. (in
my original version, I had the User instead of the RO).

The (A) and (C) flows are shown to go through the User-Agent to make it
clear it is a redirect flow in contrast to (D) and (E) in which the Client
directly talks to the AS.

ᐧ

On Thu, Jul 30, 2020 at 9:57 AM Warren Parad <[email-masked]> wrote:

>>> Can we avoid using (1, 2, 3) on the left side of the diagram to
>>> describe, I'm not even sure what they are supposed to represent, not to
>>> mention the RO in the diagram doesn't really provide value (for me)
>>> relevant to the code grant flow. It's confusing to see these numerical
>>> identifiers twice in the same picture. But maybe there is something hidden
>>> in this that I'm missing, still 3a and 3b could be used to identify
>>> different legs of the same code path.
>>>
>>>
>>> *Warren Parad*

---

From: Warren Parad <[email-masked]>
Date: Thu, 30 Jul 2020 19:28:42 +0200

Wow only now I understand that, I didn't notice the hats on the arrows, and
I was further confused why (B) had two "out arrows". Would still recommend
these being 1a and 1b, 2a/b, 3a/b.

Warren Parad

Founder, CTO

---

From: Dick Hardt <[email-masked]>
Date: Thu, 30 Jul 2020 10:36:30 -0700

In retrospect, I would make the (B) line a double line with hats and arrows
at each end to indicate it is not the same as (A) and (C).

I agree that adding a sub label will clarify which leg is first, and which
is second.

I also think we should change "User authenticates" to be "User interaction"
as there is both user authN and user consent.

We also are using 2 terms for the User (User in the flow, and RO in the
box). We should settle on one.

ᐧ

On Thu, Jul 30, 2020 at 10:28 AM Warren Parad <[email-masked]> wrote:

> Wow only now I understand that, I didn't notice the hats on the arrows,
> and I was further confused why (B) had two "out arrows". Would still
> recommend these being 1a and 1b, 2a/b, 3a/b.
>
> Warren Parad
>
> Founder, CTO