IETF Logo Mail Archive

[OAUTH-WG] Doc Shepherd Review - OAuth 2.0 Authorization Server Issuer Identification

Rifaat Shekh-Yusef <rifaat.s.ietf@gmail.com> Sat, 04 September 2021 14:21 UTC

Return-Path: <rifaat.s.ietf@gmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3DA63A184B for <oauth@ietfa.amsl.com>; Sat, 4 Sep 2021 07:21:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2RZ9cKpgxXf5 for <oauth@ietfa.amsl.com>; Sat, 4 Sep 2021 07:21:06 -0700 (PDT)
Received: from mail-lj1-x22e.google.com (mail-lj1-x22e.google.com [IPv6:2a00:1450:4864:20::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF0763A1847 for <oauth@ietf.org>; Sat, 4 Sep 2021 07:21:05 -0700 (PDT)
Received: by mail-lj1-x22e.google.com with SMTP id m4so3366609ljq.8 for <oauth@ietf.org>; Sat, 04 Sep 2021 07:21:05 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:from:date:message-id:subject:to; bh=/qQ00A9H7SkNgNZTwg1WZkJ6GF9Aw5mf1rOb8jSB1NY=; b=Rrahndpjz3MTobkjQhpJNiFUh1Oyl2/m4YYCg8d6uCivSRv5CmlSYgLS6igPDsiQ7e 93ZlRrY/myqdHU5/tlby5lJMrS1z8SYp2GSqPS27ONR7a9jdFYzyfk6OGnAVEJQfa1JW Bjz5uQEdUUUF8oOSCKmeAdLwmbbFH5XwN3XigCK1yB7Zrpbh1YlucDOmEESHEicJBILY G54RpCx/g+CRjnsM6KpkR1DGUSba0n2Ep/cxWrsRfM7e19u45Mubco/eAnWhUMhSsqLP /xVDXP2UWZVYMokMiE2QxL2w5vbjayHVya/yPu+ps+lHENvgq82OUCkyybgC4dy0Qcqi B1dQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=/qQ00A9H7SkNgNZTwg1WZkJ6GF9Aw5mf1rOb8jSB1NY=; b=Z2rqZpw8DkncaCL9c0MaJOYvjjqThsE6sUt2Cp9QzvC+E8R8xeXL3qzsvYFx4BkWmI 4TddRHtcoA+Vk3uYC8MLEs570hD5O1AK+gUcYCS7kdxtjZ/SX+CG39h3Heg59GaGiWLv D+pwTz7GJVLEYlw3oZpyevhW/GaivOwDxGvAHcNy0G9MqoflKL5/rLtMjj1U455tVE0e cv5trcykeQleZ6Ic7uApFbVxDvBYKTrwYGV1/GQBn2zsPOa2AT4wA/VBe0ye60He7D1M c5F6/DuBmUztxikfAQXh5zopHDIAaqtrYAIWDrj9uVi9HxbyoOJg0OlNiTeBWbZHgKWS 8t/w==
X-Gm-Message-State: AOAM531sNm1Hp1NL1/u4SzI/W5h4MO1lNOpyNO1EQAFJG2nZwjGacYDp 7sXiAXJoO5gRMr/1206CK6o0tXRsJtQOMkpBCbk5vyEKvnc=
X-Google-Smtp-Source: ABdhPJw/kLfkg9q1uZ5xRUrns2O68S2uV8zYRwAMPUBkTGQQdp1aFxLjcXLl1kZ0rbDt5eLulRVENi1qhL6OWu3HoLY=
X-Received: by 2002:a2e:b8d2:: with SMTP id s18mr3032782ljp.529.1630765262149; Sat, 04 Sep 2021 07:21:02 -0700 (PDT)
MIME-Version: 1.0
From: Rifaat Shekh-Yusef <rifaat.s.ietf@gmail.com>
Date: Sat, 04 Sep 2021 10:20:51 -0400
Message-ID: <CADNypP_=s0hMsof+qOQ_66FfQ-0kxaDq5oZmUr9i8JN6tzCUjA@mail.gmail.com>
To: oauth <oauth@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000299da505cb2c206e"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/CSVXkjA7RPTHUecrDUXA8OuUJyA>
Subject: [OAUTH-WG] Doc Shepherd Review - OAuth 2.0 Authorization Server Issuer Identification
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 04 Sep 2021 14:21:09 -0000

Hi Karsten, Daniel,

As the document shepherd, I have reviewed the document and I have the
following comments on draft-ietf-oauth-iss-auth-resp-01 version:


Section 2.4, paragraph 3, first sentence:

"If clients interact with both authorization servers supporting this
   specification and authorization servers not supporting this
   specification, clients SHOULD store the information which
   authorization server supports the "iss" parameter."

Why is this a SHOULD?


"Clients MUST
   reject authorization responses without the "iss" parameter from
   authorization servers which do support the parameter according to the
   client's configuration."

What should the client do when it receives a response with "iss" parameter
from an authorization server that did not indicate its support for this
parameter?


Section 7

RFC6479 should be replaced with *RFC6749*


Regards,
  Rifaat

v2.23.0 | Report a Bug | By Email