[OAUTH-WG] Resource Owner Password Credential error response question

[George Fletcher <[e-mail]>]

I have a situation where some "trusted" clients would like to use the 
ROPC flow. However, there are a number of external circumstances that 
can block the request even though the user's credentials are actually 
valid. Basically, from a back-end perspective we want to force the user 
through a web flow. I looked through the list of error responses and 
none seem to fit. 'invalid_grant' is the closest but that wouldn't give 
the client any indication that the user might be able to successfully 
complete the authorization flow if the client sends the user through a 
web flow instead of the ROPC flow.

Now I know one answer... which is... to just always use the web flow :)

Has any one else run into this? Do I register a new error response via 
Section 11.4? In looking at the template it doesn't appear possible to 
add error responses to an existing flow.

Does that mean I'd need to create an extension grant that is basically 
the same as the ROPC but because it's an extension now can have 
additional error responses?

Best practice guidance greatly appreciated! :)

Thanks,
George


-- 
George Fletcher <http://connect.me/gffletch>