Re: [OAUTH-WG] Missing Client Credentials on Token Endpoint

(a) is more appropriate. See -13 for revised language.

EHL

> -----Original Message-----
> From: oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf
> Of Stuebner, Christian (extern)
> Sent: Wednesday, February 16, 2011 8:01 AM
> To: 'oauth@ietf.org'
> Subject: [OAUTH-WG] Missing Client Credentials on Token Endpoint - Which
> Error Response?
> 
> Hi all,
> 
> I noticed a minor change in wording for the error response codes at the
> token endpoint (see citation below).
> But I'm still not sure how an authorization server is expected to behave in
> cases where he supports client password authentication via request
> parameters and HTTP Basic authentication and the client included neither of
> them in the request.
> 
> Since one could argue that "no credentials" are also "invalid credentials" the
> authorization server could do:
> a) Send status code 401 and WWW-Authenticate Basic as header
> b) Send status code 400 and error code invalid_client
> 
> I'm more in favor of a) because it seems to be more HTTP-like (or RESTful if
> you will) but I'm afraid b) is what was initially intended.
> How are your implementations handling this case? Should we be more
> specific in the spec?
> 
> 
> draft-10 (chapter 4.3):
> -----------------------
> If the client provided invalid credentials using an HTTP authentication scheme
> via the Authorization request header field, the authorization server MUST
> respond with the HTTP 401 (Unauthorized) status code. Otherwise, the
> authorization server SHALL respond with the HTTP 400 (Bad Request) status
> code.
> [...]
>     invalid_client: The client identifier provided is invalid, the client failed to
> authenticate, the client did not include its credentials, provided multiple
> client credentials, or used unsupported credentials type.
> 
> 
> draft-12 (chapter 5.2):
> -----------------------
> If the client provided invalid credentials using an HTTP authentication scheme
> via the Authorization request header field, the authorization server MUST
> respond with a HTTP 401 (Unauthorized) status code, and include the WWW-
> Authenticate response header field matching the authentication scheme
> used by the client. Otherwise, the authorization server MUST respond with
> the HTTP 400 (Bad Request) status code.
> [...]
>     invalid_client: Client authentication failed (e.g. unknown client, no client
> credentials included, multiple client credentials included, or unsupported
> credentials type).
> 
> 
> 
> Regards,
> Christian Stübner
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth

Re: [OAUTH-WG] Missing Client Credentials on Token Endpoint - Which Error Response?