Subject: Re: [OAUTH-WG] Mail regarding draft-ietf-oauth-v2

From: Dick Hardt <[email-masked]>
Date: Sat, 14 Jul 2012 17:18:49 -0700

Great suggestion Charles. I think this is a good clarification. I'll adjust the copy you sent to be what follows in a new draft published tomorrow evening (Sunday PT) unless someone objects.

-- Dick

In both sections 4.1.2.1 and 4.2.2.1:
 
  server_error
       The authorization server encountered an unexpected
       condition which prevented it from fulfilling the request. 
       This error code is needed because a 500 Internal Server
       Error HTTP status code cannot be returned to the client
       via a HTTP redirect.
  temporarily_unavailable
       The authorization server is currently unable to handle
       the request due to a temporary overloading or maintenance
       of the server.  This error code is needed because a 503 Service
       Unavailable HTTP status code cannot be returned to the client
       via a HTTP redirect.

On Jul 13, 2012, at 9:45 AM, Honton, Charles wrote:

> Just to make sure I understand…
> 
> If  the Authorization Server returns a 5xx,  the User-Agent will immediately display a error message.
> 
> If  the Authorization Server returns an error code in the redirect,  the Client can take alternative actions or appropriately message the error.
> 
> If this is correct, perhaps a slight change in wording will explain the lack of symmetry in the error codes. 
> 
> In both sections 4.1.2.1 and 4.2.2.1:
> 
> 	server_error
>                The authorization server encountered an unexpected
>                condition which prevented it from fulfilling the request. 
> 	       Using this error code allows the Client to handle this 
>                condition instead of the User-Agent
>          temporarily_unavailable
>                The authorization server is currently unable to handle
>                the request due to a temporary overloading or maintenance
>                of the server.  Using this error code allows the Client 
>                to handle this condition instead of the User-Agent
> 
> Thanks,
> chas
> 
> From: John Bradley <[email-masked]>
> Date: Friday, July 13, 2012 9:08 AM
> To: Charles Honton <[email-masked]>
> Cc: Dick Hardt <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked] WG" <[email-masked]>
> Subject: Re: [OAUTH-WG] Mail regarding draft-ietf-oauth-v2
> 
> 4.2.2.1 and 4.1.2.1 are error codes that are returned to the client through the browser via a 302 redirect.
> 
> You can't send a 5xx error via a 302 redirect.
> 
> That is why those need error messages specific to OAuth.  
> 
> Errors not being sent via redirect use normal http error codes.
> 
> I thought that was clear.  Is there some general confusion on this?
> 
> John B.
> On 2012-07-13, at 11:55 AM, Honton, Charles wrote:
> 
>> Great! Because this question has come up multiple times, perhaps the rfc could explain the use of 5xx return code in addition to error_code.
>> 
>> I must be missing something.  Why are  server_error and temporarily_unavailable specified in sections 4.2.2.1 and 4.1.2.1?  Is there a distinction between 5xx return code and error_code in these cases?
>> 
>> Chas
>> 
>> From: John Bradley <[email-masked]>
>> Date: Friday, July 13, 2012 4:04 AM
>> To: Dick Hardt <[email-masked]>
>> Cc: Charles Honton <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked] WG" <[email-masked]>
>> Subject: Re: [OAUTH-WG] Mail regarding draft-ietf-oauth-v2
>> 
>> FRom what I can see in a similar discussion Eran pointed out that this is a direct communication, communication between the client and token endpoint.
>> 
>> Server Error and temporarily unavailable are not OAuth specific and are handled by existing HTTP error codes.
>> 
>> I don't see a need for a change.
>> 
>> Unless something else dramatic comes up I would like to see draft 29 go to the RFC editor.
>> 
>> (Though one person mentioned to me that 30 is a nicer number:)
>> 
>> John B.
>> 
>> On 2012-07-12, at 8:09 PM, Dick Hardt wrote:
>> 
>>> Charles
>>> 
>>> Thanks for the suggestion. I just did publish a new draft that included a number of items that had been discussed and I would like to get some feedback on your suggestion before incorporating it (or not).
>>> 
>>> Does anyone have feedback on the change below? (+/-)
>>> 
>>> -- Dick
>>> 
>>> On Jul 12, 2012, at 1:45 PM, Honton, Charles wrote:
>>> 
>>>> E. Hammer, D. Recordon, D. Hardt, et.al,
>>>> 
>>>> I'm looking at draft 28 (http://tools.ietf.org/html/draft-ietf-oauth-v2-28).
>>>> 
>>>> In Section 5.2 the error code should probably include:
>>>> 
>>>> 	server_error
>>>>                The authorization server encountered an unexpected
>>>>                condition which prevented it from fulfilling the request.
>>>>          temporarily_unavailable
>>>>                The authorization server is currently unable to handle
>>>>                the request due to a temporary overloading or maintenance
>>>>                of the server.
>>>> 
>>>> 
>>>> Regards,
>>>> chas
>>>> 
>>> 
>>> _______________________________________________
>>> OAuth mailing list
>>> [email-masked]
>>> https://www.ietf.org/mailman/listinfo/oauth
>> 
>

---

From: John Bradley <[email-masked]>
Date: Sat, 14 Jul 2012 18:39:39 -0600

I am OK with that wording.  It is not a change just a clarification that may make things clearer to developers.

John B.

---

From: Mike Jones <[email-masked]>
Date: Sun, 15 Jul 2012 00:43:06 +0000

I'm good with this change.

BTW, I suggest we put parenthesis around the new sentences, making it clear that they are an aside, rather than a normative part of the error code definitions.  So the text would then read:

  server_error

       (This error code is needed because a 500 Internal Server

       via a HTTP redirect.)

  temporarily_unavailable

       of the server.  (This error code is needed because a 503 Service

       via a HTTP redirect.)

                                                            -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of John Bradley
Sent: Saturday, July 14, 2012 5:40 PM
To: Dick Hardt
Cc: [email-masked]; Honton, Charles; [email-masked] WG
Subject: Re: [OAUTH-WG] Mail regarding draft-ietf-oauth-v2

John B.

-- Dick

  server_error

       via a HTTP redirect.

  temporarily_unavailable

       via a HTTP redirect.

Just to make sure I understand...

       server_error

         temporarily_unavailable

Thanks,
chas

From: John Bradley <[email-masked]<mailto:[email-masked]>>
Date: Friday, July 13, 2012 9:08 AM
To: Charles Honton <[email-masked]<mailto:[email-masked]>>
Cc: Dick Hardt <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]> WG" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [OAUTH-WG] Mail regarding draft-ietf-oauth-v2

John B.

Chas

From: John Bradley <[email-masked]<mailto:[email-masked]>>
Date: Friday, July 13, 2012 4:04 AM
To: Dick Hardt <[email-masked]<mailto:[email-masked]>>
Cc: Charles Honton <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]> WG" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [OAUTH-WG] Mail regarding draft-ietf-oauth-v2

John B.

Charles

-- Dick

       server_error

         temporarily_unavailable

               of the server.

Regards,
chas

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth