Re: [OAUTH-WG] OAuth Digest, Vol 136, Issue 9

No, I cannot see any use case where authorization code cannot replace
implicit. Go ahead and remove it!

Bruno

On Wed, Feb 19, 2020 at 5:01 PM <oauth-request@ietf.org> wrote:

> Send OAuth mailing list submissions to
>         oauth@ietf.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://www.ietf.org/mailman/listinfo/oauth
> or, via email, send a message with subject or body 'help' to
>         oauth-request@ietf.org
>
> You can reach the person managing the list at
>         oauth-owner@ietf.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of OAuth digest..."
> Today's Topics:
>
>    1. Re: OAuth 2.1 - drop implicit flow? (Dominick Baier)
>    2. Re: OAuth Digest, Vol 136, Issue 7 (Torsten Lodderstedt)
>    3. Re: [EXTERNAL]  OAuth 2.1: dropping password grant (Dick Hardt)
>
>
>
> ---------- Forwarded message ----------
> From: Dominick Baier <dbaier@leastprivilege.com>
> To: Dick Hardt <dick.hardt@gmail.com>, oauth@ietf.org
> Cc:
> Bcc:
> Date: Tue, 18 Feb 2020 22:49:05 -0800
> Subject: Re: [OAUTH-WG] OAuth 2.1 - drop implicit flow?
> No - please get rid of it.
>
> ———
> Dominick Baier
>
> On 18. February 2020 at 21:32:31, Dick Hardt (dick.hardt@gmail.com) wrote:
>
> Hey List
>
> (I'm using the OAuth 2.1 name as a placeholder for the doc that Aaron,
> Torsten, and I are working on)
>
> Given the points Aaron brought up in
>
> https://mailarchive.ietf.org/arch/msg/oauth/hXEfLXgEqrUQVi7Qy8X_279DCNU
>
>
> Does anyone have concerns with dropping the implicit flow from the OAuth
> 2.1 document so that developers don't use it?
>
> /Dick
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>
>
>
>
> ---------- Forwarded message ----------
> From: Torsten Lodderstedt <torsten@lodderstedt.net>
> To: Bruno Brito <bhdebrito@gmail.com>
> Cc: oauth@ietf.org
> Bcc:
> Date: Wed, 19 Feb 2020 08:25:19 +0100
> Subject: Re: [OAUTH-WG] OAuth Digest, Vol 136, Issue 7
> Hi Bruno,
>
> thanks for your insights.
>
> The recommendation is not only based on security considerations but just
> utility. As soon as one wants to integrate federated login or multi factor
> authentication,  ROPG reaches its limits.
>
> Moreover, how do those teams implement user registration and user account
> recovery? In my experience, implementing this in a native experience will
> significantly increase cost of the implementation.
>
> Two reasons to go with the code flow.
>
> best regards,
> Torsten.
>
> > Am 19.02.2020 um 01:49 schrieb Bruno Brito <bhdebrito@gmail.com>:
> >
>
>
>
> ---------- Forwarded message ----------
> From: Dick Hardt <dick.hardt@gmail.com>
> To: Anthony Nadalin <tonynad@microsoft.com>
> Cc: "oauth@ietf.org" <oauth@ietf.org>
> Bcc:
> Date: Wed, 19 Feb 2020 11:35:03 -0800
> Subject: Re: [OAUTH-WG] [EXTERNAL]  OAuth 2.1: dropping password grant
> Tony: are you ok with dropping password grant?
>
> You reference valid use cases. If you think it should continue, would you
> provide the use cases?
>
> ᐧ
>
> On Tue, Feb 18, 2020 at 12:57 PM Dick Hardt <dick.hardt@gmail.com> wrote:
>
>> The security topics says MUST. If you want to change that, then that is a
>> different discussion. :)
>>
>> In the OAuth 2.1 document, it would just not be included. Applications
>> can continue to be OAuth 2.0 compliant.
>>
>> BUT ... if there are valid, new use cases. Please describe them! Perhaps
>> it should not be dropped.
>>
>>
>> On Tue, Feb 18, 2020 at 12:54 PM Anthony Nadalin <tonynad@microsoft.com>
>> wrote:
>>
>>> I would suggest a SHOULD NOT instead of MUST, there are still sites
>>> using this and a grace period should be provided before a MUST is pushed
>>> out as there are valid use cases out there still.
>>>
>>>
>>>
>>> *From:* OAuth <oauth-bounces@ietf.org> *On Behalf Of * Dick Hardt
>>> *Sent:* Tuesday, February 18, 2020 12:37 PM
>>> *To:* oauth@ietf.org
>>> *Subject:* [EXTERNAL] [OAUTH-WG] OAuth 2.1: dropping password grant
>>>
>>>
>>>
>>> Hey List
>>>
>>>
>>>
>>> (Once again using the OAuth 2.1 name as a placeholder for the doc that
>>> Aaron, Torsten, and I are working on)
>>>
>>>
>>>
>>> In the security topics doc
>>>
>>>
>>>
>>>
>>> https://tools.ietf.org/html/draft-ietf-oauth-security-topics-14#section-2.4
>>> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-ietf-oauth-security-topics-14%23section-2.4&data=02%7C01%7Ctonynad%40microsoft.com%7C47bb597eef584c95ba4108d7b4b274b2%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637176550905333283&sdata=nA1S7TBfZg6cSwY2hI8hpRXhIA2joaaJFmNXrATgr2Y%3D&reserved=0>
>>>
>>>
>>>
>>> The password grant MUST not be used.
>>>
>>>
>>>
>>> Some background for those interested. I added this grant into OAuth 2.0
>>> to allow applications that had been provided password to migrate. Even with
>>> the caveats in OAuth 2.0, implementors decide they want to prompt the user
>>> to enter their credentials, the anti-pattern OAuth was created to
>>> eliminate.
>>>
>>>
>>>
>>>
>>>
>>> Does anyone have concerns with dropping the password grant from the
>>> OAuth 2.1 document so that developers don't use it?
>>>
>>>
>>>
>>> /Dick
>>>
>> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>