Re: [OAUTH-WG] Namespacing "type" in RAR

[Vladimir Dzhuvinov <[e-mail]>]

On 17/07/2020 17:38, Justin Richer wrote:
> And all that brings me to my proposal: 
>
> 4) Require all values to be defined by the AS, and encourage specification developers to use URIs for collision resistance.
>
> So officially in RAR, the AS would decide what “type” means, and nobody else. But we can also guide people who are developing general-purpose interoperable APIs to use URIs for their RAR “type” definitions. This would keep those interoperable APIs from stepping on each other, and from stepping on any locally-defined special “type” structure. But at the end of the day, the URI carries no more weight than just any other string, and the AS decides what it means and how it applies.

Define, but not publish in AS metadata?


> My argument is that this seems to have worked very, very well for scopes, and the RAR “type” is cut from similar descriptive cloth.

I would argue that it didn't work so well for scopes - the OAuth
Resource Indicators spec is a testament to that.

But one could also argue that scopes were not defined along the lines of
your proposal for "type" in RAR. In fact, RFC 6749 has no mention of
collision resistance or name spacing for scope values.


Vladimir