Subject: [OAUTH-WG] Device flow feedback

From: Chris Needham <[email-masked]>
Date: Wed, 5 Jul 2017 10:02:45 +0000

Hi,

I'm one of the contributors to the ETSI Cross Platform Authentication spec [1], which was based on an early draft of the OAuth 2.0 Device Flow.

One of the things we found useful, and not included in the current OAuth 2.0 Device Flow [2, section 3.5], is a return code for the case where the authorization server decides to cancel the pairing process. This may be due to a user interaction, such as declining the presented terms and conditions, for example. Such a return code allows the client to stop polling and to display an appropriate message to the user. (I didn't find a suitable error code in RFC6749.) 

In the ETSI spec we used the error code 'cancelled' for this purpose:

cancelled

  The authorization server has cancelled the pairing process. This can occur,
  for example, if the user declined to authorize the client, e.g., by not
  accepting terms and conditions presented to them by the authorization server.

Best regards,

Chris

[1] http://www.etsi.org/deliver/etsi_ts/103400_103499/103407/01.01.01_60/ts_103407v010101p.pdf
[2] https://tools.ietf.org/id/draft-ietf-oauth-device-flow-06.txt

--
Chris Needham
Principal Software Engineer
BBC Research & Development
Centre House, 56 Wood Lane, London W12 7SB

---

From: Thomas Broyer <[email-masked]>
Date: Wed, 05 Jul 2017 10:16:09 +0000

Wouldn't expired_token be appropriate here?

On Wed, Jul 5, 2017 at 12:02 PM Chris Needham <[email-masked]>
wrote:

> Hi,
>
> I'm one of the contributors to the ETSI Cross Platform Authentication spec
> [1], which was based on an early draft of the OAuth 2.0 Device Flow.
>
> One of the things we found useful, and not included in the current OAuth
> 2.0 Device Flow [2, section 3.5], is a return code for the case where the
> authorization server decides to cancel the pairing process. This may be due
> to a user interaction, such as declining the presented terms and
> conditions, for example. Such a return code allows the client to stop
> polling and to display an appropriate message to the user. (I didn't find a
> suitable error code in RFC6749.)
>
> [1]
> http://www.etsi.org/deliver/etsi_ts/103400_103499/103407/01.01.01_60/ts_103407v010101p.pdf
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Chris Needham <[email-masked]>
Date: Wed, 5 Jul 2017 10:23:44 +0000

It’s useful to be able to distinguish those cases from the client’s point of view.

From: Thomas Broyer [mailto:[email-masked]]
Sent: 05 July 2017 11:16
To: Chris Needham <[email-masked]>; [email-masked]
Subject: Re: [OAUTH-WG] Device flow feedback

On Wed, Jul 5, 2017 at 12:02 PM Chris Needham <[email-masked]<mailto:[email-masked]>> wrote:
Hi,

cancelled

Best regards,

Chris

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth