Subject: [OAUTH-WG] Reconciling section 2.2 with 3.2.1

From: Andrew Arnott <[email-masked]>
Date: Sun, 12 Feb 2012 20:21:54 -0800

Can anyone please help me understand how these two sentences do not
contradict?

>From section 2.2 Client Identifier

> The client identifier is not a secret, it is exposed to the resource
> owner, and *MUST NOT be used alone* for client authentication.

>From section 3.2.1 Client Authentication
>
> A public client that was not issued a client password MAY use the
> client_id request parameter to identify itself when sending requests to
> the token endpoint.

Thanks.

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death
your right to say it." - S. G. Tallentyre

---

From: Eran Hammer <[email-masked]>
Date: Sun, 12 Feb 2012 23:12:14 -0700

Identification isn't authentication. A public client can identify itself for the purpose of providing user context, statistics, etc.

EH

From: [email-masked] [mailto:[email-masked]] On Behalf Of Andrew Arnott
Sent: Sunday, February 12, 2012 8:22 PM
To: OAuth WG ([email-masked])
Subject: [OAUTH-WG] Reconciling section 2.2 with 3.2.1

Can anyone please help me understand how these two sentences do not contradict?

>From section 2.2 Client Identifier
The client identifier is not a secret, it is exposed to the resource owner, and MUST NOT be used alone for client authentication.

>From section 3.2.1 Client Authentication
A public client that was not issued a client password MAY use the client_id request parameter to identify itself when sending requests to the token endpoint.

Thanks.

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre

---

From: Andrew Arnott <[email-masked]>
Date: Mon, 13 Feb 2012 10:08:23 -0800

Fair enough.  Thanks, Eran.  Is that generally a clear distinction to the
rest of the community already, or should this distinction be described in
section 3.2.1?

On Sunday, February 12, 2012, Eran Hammer wrote:

> Identification isn’t authentication. A public client can identify itself
> for the purpose of providing user context, statistics, etc.****
>
> ** **
>
> EH****
>
> ** **
>
> *From:* [email-masked] <javascript:_e({}, 'cvml',
> [email-masked]');> [mailto:[email-masked]<javascript:_e({}, 'cvml', [email-masked]');>]
> *On Behalf Of *Andrew Arnott
> *Sent:* Sunday, February 12, 2012 8:22 PM
> *To:* OAuth WG ([email-masked] <javascript:_e({}, 'cvml',
> [email-masked]');>)
> *Subject:* [OAUTH-WG] Reconciling section 2.2 with 3.2.1****
>
> ** **
>
> contradict?****
> ** **
> From section 2.2 Client Identifier****
>
> owner, and *MUST NOT be used alone* for client authentication. ****
>
> ** **
>
> From section 3.2.1 Client Authentication****
>
> the token endpoint. ****
> ** **
> Thanks.****
> your right to say it." - S. G. Tallentyre****
>