Subject: [OAUTH-WG] OAuth Parameter Registration Template

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 24 Jun 2012 16:17:48 +0300

Hi all, 

working on the proposed text for the OAuth assertions draft I noticed an interesting aspect in the core specification regarding Section 11.2.1, which defines the registration template for OAuth parameters. 

The template lists all possible usage locations of parameters, namely authorization request, authorization response, token request, or token response.

Here is the first issue: these locations are not defined anywhere in the document and so one can only guess to what part of the protocol exchange they belong. 

I agree that it may not be very difficult to guess but obviously it is not completely obvious. It would have been nice if there is actually a match with Figure 1, for example. 

http://tools.ietf.org/html/draft-ietf-oauth-assertions-03, for example, uses a location that is not in the above list, namely 'client authentication'. 

Client authentication can also happen in the interaction between the client and the resource server but the exchanges are not part of the allowed list of usage locations. 

Ciao
Hannes

---

From: Eran Hammer <[email-masked]>
Date: Sun, 24 Jun 2012 13:34:58 +0000

It is pretty obvious these refer to the two well defined endpoints in section 3. I will add a reference next to the locations to make this even clearer.

There is no such endpoint as client authentication as a location. OAuth core clearly defines three endpoints for which two are extensible via regisration. Anything else is out of scope.

No other changes are needed or appropriate.

EH

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Hannes Tschofenig
> Sent: Sunday, June 24, 2012 6:18 AM
> To: OAuth WG
> Subject: [OAUTH-WG] OAuth Parameter Registration Template
> 
> Hi all,
> 
> working on the proposed text for the OAuth assertions draft I noticed an
> interesting aspect in the core specification regarding Section 11.2.1, which
> defines the registration template for OAuth parameters.
> 
> The template lists all possible usage locations of parameters, namely
> authorization request, authorization response, token request, or token
> response.
> 
> Here is the first issue: these locations are not defined anywhere in the
> document and so one can only guess to what part of the protocol exchange
> they belong.
> 
> I agree that it may not be very difficult to guess but obviously it is not
> completely obvious. It would have been nice if there is actually a match with
> Figure 1, for example.
> 
> http://tools.ietf.org/html/draft-ietf-oauth-assertions-03, for example, uses a
> location that is not in the above list, namely 'client authentication'.
> 
> Client authentication can also happen in the interaction between the client
> and the resource server but the exchanges are not part of the allowed list of
> usage locations.
> 
> Ciao
> Hannes
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Brian Campbell <[email-masked]>
Date: Sun, 24 Jun 2012 08:02:02 -0600

> http://tools.ietf.org/html/draft-ietf-oauth-assertions-03, for example, uses a location that is not in the above list, namely 'client authentication'.

That's a mistake in
http://tools.ietf.org/html/draft-ietf-oauth-assertions-03 - I actually
thought I'd reconciled all the parameter usage location registry stuff
in that latest draft but apparently it still needs some work.

---

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 24 Jun 2012 19:41:20 +0300

Hi Eran, 

On Jun 24, 2012, at 4:34 PM, Eran Hammer wrote:

> It is pretty obvious these refer to the two well defined endpoints in section 3.

True. The first few paragraphs of Section 3 lists the available end points. 

Btw, the section headings are a bit strange: 

3. Protocol Endpoints 
3.1 Authorization Endpoint
3.2 Token Endpoint
3.3 Access Token Scope 

> I will add a reference next to the locations to make this even clearer.
> 
Thanks. 

Maybe you want to add that this specification only defines these usage locations for parameter (based on the defined endpoints) and other documents may define new end points and extend the list of possible parameter usage locations. 

> There is no such endpoint as client authentication as a location.

Notice that. 

> OAuth core clearly defines three endpoints for which two are extensible via regisration. Anything else is out of scope.

While the specification says that you can define new endpoints it may be useful to link that statement with the usage location for the parameters. 

Ciao
Hannes