Re: [OAUTH-WG] device profile comments

Thanks!

On Thu, Apr 22, 2010 at 4:49 PM, Brian Eaton <beaton@google.com> wrote:
>
> So I’d propose changing the profile as follows:
>
> - Client requests device code by sending type=device and client_id=<id>
>

I might be reading something different than you are, but according to
http://tools.ietf.org/html/draft-hammer-oauth2-00#section-3.5.3.1 those are
the parameters included.

> - Authorization server doesn’t return approval URL - device hard-codes
> this instead.
>   I expect that this will point to a manufacturer specific page, and
> that the manufacturer specific page will automatically redirect to a
> page on the authorization server.
>

By having the Authorization Server pass the Client the approval URL it's
much easier to change over the lifetime of a living room device. This could
be in your application settings (for Facebook's usage) if it's pointing to a
page on the manufacturer's site. Or it gives the Authorization Server the
ability to change it if they're hosting the page.

> - Approval URL MUST have client_id, and MAY have callback.
>   I expect that the client_id will be used to brand the approval
> page, and that the callback will point to a manufacturer specific
> completion page.
>

I don't fully understand what you're proposing. The device would show a
screen which tells the user to visit http://fb.me/xbox and enter the code
123456. (Or to visit http://xbox.com/fb.) Asking a user to go to
http://goo.gl/?client_id=bndi12boi1 seems like it's prone to user error.

Plus a few comments on error codes:
>
> “End User Authorization Pending or Expired” - authorization server
> probably isn’t going to be able to tell whether a code has expired, or
> was never issued.  Probably just return “unknown_code”.
>
> The “slow_down” error probably merits an “interval”.  Maybe always
> return “interval” with authorization_pending, and eliminate the
> slow_down error code entirely?
>
> Cheers,
> Brian
>
> [1] http://sites.google.com/site/oauthgoog/UXFedLogin/desktopapps
> [2] http://sites.google.com/site/oauthgoog/UXFedLogin/nobrowser
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>