Re: [OAUTH-WG] Client cannot specify the token type it needs

[William Mills <[e-mail]>]

Not a problem for the client to request a type, but it may not get it.


________________________________
 From: "[e-mail]" <[e-mail]>
To: Prabath Siriwardena <[e-mail]> 
Cc: "[e-mail] WG" <[e-mail]>; William Mills <[e-mail]> 
Sent: Sunday, January 20, 2013 9:38 PM
Subject: Re: Re: Re: [OAUTH-WG] Client cannot specify the token type it needs
 


Well, if RS could specify token type,
then Client could transfer it to AS,  
I think, but it is not a good idea for
client itself to specify the token type.  


Prabath Siriwardena <[e-mail]> 写于
2013-01-21 13:29:05:

> Think about a distributed setup. You have single Authorization 
> Server and multiple Resource Servers. 
> 
> Although OAuth nicely decouples AS from RS - AFAIK there is no 
> standard established for communication betweens AS and RS - how to 
> declare metadata between those. 
> 
> Also there can be Resource Servers which support multiple token 
> types. It could vary on APIs hosted in a given RS. 
> 
> Thanks & regards, 
> -Prabath 
> 
> On Mon, Jan 21, 2013 at 10:48 AM, <[e-mail]> wrote: 
> 
> The token type shoulbe decided by resource server, which consumes 
> access token. 
> Client just re-tell the requested token type to AS. 
> Client should not specify the token type. 
> 
> 
> [e-mail] 写于 2013-01-21 13:08:39: 
> 
> 
> > This is true.  It's possible for the AS to vary it's behavior
on 
> > scope name, but it's presumed the AS and RS have an agreement
of 
> > what token type is in play.  Likely a good extension to
the spec. 
> 
> >  
> > From: Prabath Siriwardena <[e-mail]>
> > To: "[e-mail] WG" <[e-mail]> 
> > Sent: Sunday, January 20, 2013 7:28 PM
> > Subject: [OAUTH-WG] Client cannot specify the token type it needs 
> 
> > 
> > Although token type is extensible according to the OAuth core 
> > specification - it is fully governed by the Authorization Server. 
> > 
> > There can be a case where a single AS supports multiple token
types 
> > based on client request. 
> > 
> > But currently we don't have a way the client can specify (or
at 
> > least suggest) which token type it needs in the OAuth access
tokenrequest ?
> > 
> > Is this behavior intentional ? or am I missing something... 
> > 
> > Thanks & Regards,
> > Prabath 
> > 
> > Mobile : [phone] 
> > 
> > http://blog.facilelogin.com
> > http://RampartFAQ.com 
> > 
> > _______________________________________________
> > OAuth mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/oauth
> > 
> > _______________________________________________
> > OAuth mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/oauth 
> 
 
> 
> -- 
> Thanks & Regards,
> Prabath 
> 
> Mobile : [phone] 
> 
> http://blog.facilelogin.com
> http://RampartFAQ.com