Re: [Gen-art] [OAUTH-WG] Gen-ART Telechat review of draft-ietf-oauth-v2-bearer-18.txt

Sean Turner <> Wed, 11 April 2012 23:42 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id DC4DF21F8554 for <>; Wed, 11 Apr 2012 16:42:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -102.665
X-Spam-Status: No, score=-102.665 tagged_above=-999 required=5 tests=[AWL=-0.400, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id qLxKKFQqYE-z for <>; Wed, 11 Apr 2012 16:42:12 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 3B5A421F854F for <>; Wed, 11 Apr 2012 16:42:12 -0700 (PDT)
Received: by (Postfix, from userid 5007) id B74B4321EB2FE; Wed, 11 Apr 2012 18:42:11 -0500 (CDT)
Received: from ( []) by (Postfix) with ESMTP id A9C1A321EB2D1 for <>; Wed, 11 Apr 2012 18:42:11 -0500 (CDT)
Received: from [] (port=33351 helo=thunderfish.local) by with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.69) (envelope-from <>) id 1SI7Aw-0007HK-RI; Wed, 11 Apr 2012 18:42:11 -0500
Message-ID: <>
Date: Wed, 11 Apr 2012 19:42:09 -0400
From: Sean Turner <>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0) Gecko/20120327 Thunderbird/11.0.1
MIME-Version: 1.0
To: Mike Jones <>
References: <>
In-Reply-To: <>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname -
X-AntiAbuse: Original Domain -
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain -
X-BWhitelist: no
X-Source-Sender: (thunderfish.local) []:33351
X-Email-Count: 7
X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IxNzQzLmhvc3RnYXRvci5jb20=
Cc: General Area Review Team <>, "" <>, "" <>, The IESG <>
Subject: Re: [Gen-art] [OAUTH-WG] Gen-ART Telechat review of draft-ietf-oauth-v2-bearer-18.txt
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "GEN-ART: General Area Review Team" <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 11 Apr 2012 23:42:13 -0000

On issue 2, Russ has already entered his ballot on the base spec so I'll 
pick this one up.


On 4/10/12 8:25 PM, Mike Jones wrote:
> Hi Alexey,
> About your issue 1:  The OAuth Core spec, where "scope" is primarily defined, includes the sentence "The [scope] strings are defined by the authorization server" (see  I could add that clarification to the Bearer spec as well to make it clear that the scope values are context-dependent, if that would address your concern.
> About your issue 2:  Investigating the OAuth Errors Registry a bit further (see while I'd like to be able to register the OAuth Bearer errors in this registry, what I believe to be a defect in the errors registry text currently prevents this.  Specifically, the registry enumerates only three "Error usage location" values:  authorization code grant error response, implicit grant error response, and token error response.  To be able to use this registry, it would also have to have a fourth usage location:  "resource access error response".  If you'd like to file an issue against the OAuth Core spec to get this additional usage location added to the registry, then I'd be glad to use it.  I believe that this would be significantly preferable to adding a separate OAuth Bearer errors registry that's exactly like the general-purpose one, only separate from it.
> 				Best wishes,
> 				-- Mike
> -----Original Message-----
> From: [] On Behalf Of Alexey Melnikov
> Sent: Tuesday, April 10, 2012 7:03 AM
> To:
> Cc: General Area Review Team;; The IESG
> Subject: [OAUTH-WG] Gen-ART Telechat review of draft-ietf-oauth-v2-bearer-18.txt
> I am the assigned Gen-ART reviewer for this draft. For background on Gen-ART, please see the FAQ at<>aq>.
> Please resolve these comments along with any other Last Call comments you may receive.
> Document: draft-ietf-oauth-v2-bearer-18.txt
> Reviewer: Alexey Melnikov
> Review Date: 10 April 2012
> IETF LC End Date: 7 Feb 2012
> IESG Telechat date: 12 April 2012
> Summary: Nearly ready to be published as Proposed Standard, with a couple of things that should be addressed or at least discussed.
> Thank you for addressing most of my other issues. However there are a couple remaining which I think are important.
> Major Issues:
> 1).
>      The "scope" attribute is a space-delimited list of scope values
>      indicating the required scope of the access token for accessing the
>      requested resource.  In some cases, the "scope" value will be used
>      when requesting a new access token with sufficient scope of access to
>      utilize the protected resource.  The "scope" attribute MUST NOT
>      appear more than once.  The "scope" value is intended for
>      programmatic use and is not meant to be displayed to end users.
> I don't think this provide enough information about what this is, how it is to be used and which values are allowed. As this is not meant to be displayed to end users, then you need to say what values are allowed and which entity can allocate them. Is there a registry for these tokens, e.g. an IANA registry?
> The editor provided explanation in email, however this was not reflected in any version of the draft.
> 2). Section "3.1.  Error Codes"
> I've suggested to use an IANA registry for this field. Apparently there is already a registry created by<>.4>.
> However this document doesn't register values defined in section 3.1 with IANA and doesn't point to draft-ietf-oauth-v2-23 for the registry.
> I find this to be very confusing.
> Minor issues: none
> Nits: none
> _______________________________________________
> OAuth mailing list