Re: [OAUTH-WG] client_id in PAR and JAR

Filip,

Ok, thanks for the clarification.

Regards

On Tue, Jun 30, 2020 at 3:31 PM Filip Skokan <panva.ip@gmail.com> wrote:

> It already is in the new revision of JAR, PAR will follow it too.
>
> Technically tho, since authorization requests can also use POST its not
> strictly a query string parameter, it may be contained in the request body
> too. Let’s call it authorization endpoint parameters and leave the “how its
> transferred” mechanism out.
>
> Odesláno z iPhonu
>
> 30. 6. 2020 v 10:15, Thiloshon Nagarajah <thiloshon@wso2.com>:
>
> 
> Hi Filip,
>
> So I'm assuming client_id will be mandated as a query param in PAR as well?
>
> Regards
>
> On Tue, Jun 30, 2020 at 1:09 PM Filip Skokan <panva.ip@gmail.com> wrote:
>
>> Hi Thiloshon,
>>
>> Not quite the way it went down but we have this adressed in a future PAR
>> draft.
>>
>> Thank you ;)
>>
>> Filip
>>
>> Odesláno z iPhonu
>>
>> 30. 6. 2020 v 9:25, Thiloshon Nagarajah <thiloshon=
>> 40wso2.com@dmarc.ietf.org>:
>>
>> 
>> Hi All,
>>
>> In OAuth JAR specification, client_id is a required query parameter of
>> authorisation call, in both *request* and *request_uri* flows [
>> https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-23#section-5].
>>
>> But in OAuth PAR specification, which is a complimentary spec to JAR, it
>> is specified "Clients are encouraged to use the request URI as the only
>> parameter (in the authorisation call) in order to use the integrity and
>> authenticity provided by the pushed authorization request." [
>> https://tools.ietf.org/html/draft-ietf-oauth-par-01#section-4]
>>
>> Taking into account these both are building upon OAuth spec, which also
>> mandates client_id query param in authorisation call, it seems like PAR
>> is not compatible with OAuth and JAR specs.
>>
>> Is this intentional? If it is may I know the rationale behind this
>> decision?
>>
>> Regards,
>> --
>> Thiloshon Nagarajah
>> Software Engineer,
>> Financial Solutions
>> WSO2
>> +94774209947
>> <http://wso2.com/signature>
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
>>
>>
>
> --
> Thiloshon Nagarajah
> Software Engineer,
> Financial Solutions
> WSO2
> +94774209947
> <http://wso2.com/signature>
>
>

-- 
Thiloshon Nagarajah
Software Engineer,
Financial Solutions
WSO2
+94774209947
<http://wso2.com/signature>