Subject: [OAUTH-WG] OAuth ABNF

From: Eran Hammer <[email-masked]>
Date: Mon, 23 Apr 2012 21:19:30 +0000

During the IESG review of draft-ietf-oauth-v2, Sean Turner raised the following DISCUSS item (meaning, the specification is blocked until this is resolved):

> 0) General: I found the lack of ABNF somewhat disconcerting in that

> implementers would have to hunt through the spec to figure out all the

> values of a given field.  For example grant_type has different values based

> on the different kind of access_token requests - four to be more precise -

> but there's no ABNF for the field.  There are many examples of

> this.   It would greatly aid implementers if a) the ABNF for all fields

> were included in the draft and b) all the ABNF was collected in one place.  I

> had individual discusses for each field that had missing ABNF, but it was

> getting out of hand so I'm just going to do this one general discuss on this

> topic.

I don't have the time to prepare such text. Can someone volunteer to submit this text to the WG for review?

EH

---

From: Eran Hammer <[email-masked]>
Date: Tue, 24 Apr 2012 00:12:20 +0000

We can do both (provide it as defined and in one section). But someone needs to prepare all the ABNFs first.

EH

From: Chuck Canning [mailto:[email-masked]]
Sent: Monday, April 23, 2012 3:28 PM
To: Eran Hammer; [email-masked] WG ([email-masked])
Subject: RE: OAuth ABNF

As someone trying to implement the spec, I find that I have to jump around the spec to find this information also. Personally, I think grouping the related options in the document might make it more clear instead of grouping it based on a concept and then the next style of flow. It might also help shine light on the holes in the spec or where things are ambiguous or not clearly defined. (ie. clearly defining all the options for a particular URI together instead of having to jump over multiple sections and mentally comparing each option).

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]<mailto:[mailto:[email-masked]]> On Behalf Of Eran Hammer
Sent: Monday, April 23, 2012 2:20 PM
To: [email-masked]<mailto:[email-masked]> WG ([email-masked]<mailto:[email-masked]>)
Subject: [SPAM] [OAUTH-WG] OAuth ABNF
Importance: Low

EH

---

From: Julian Reschke <[email-masked]>
Date: Wed, 25 Apr 2012 14:45:54 +0200

On 2012-04-23 23:19, Eran Hammer wrote:
> During the IESG review of draft-ietf-oauth-v2, Sean Turner raised the
> following DISCUSS item (meaning, the specification is blocked until this
> is resolved):
>
> I don’t have the time to prepare such text. Can someone volunteer to
> submit this text to the WG for review?

Putting values in the ABNF makes only sense if and only of the set of 
values is hardwired, so there's no extension point. Otherwise it's 
misleading, because it will lead to fragile parser implementations.

WRT collected ABNF: this can be generated automatically, you may want to 
have a look at 
<http://trac.tools.ietf.org/wg/httpbis/trac/browser/draft-ietf-httpbis/latest/Makefile>.

Best regards, Julian