Re: [OAUTH-WG] Authorization Code Grant diagram Improvement OAuth 2.1 draft-ietf-oauth-v2-1

[Dick Hardt <[e-mail]>]

In retrospect, I would make the (B) line a double line with hats and arrows
at each end to indicate it is not the same as (A) and (C).

I agree that adding a sub label will clarify which leg is first, and which
is second.

I also think we should change "User authenticates" to be "User interaction"
as there is both user authN and user consent.

We also are using 2 terms for the User (User in the flow, and RO in the
box). We should settle on one.


ᐧ

On Thu, Jul 30, 2020 at 10:28 AM Warren Parad <[e-mail]> wrote:

> Wow only now I understand that, I didn't notice the hats on the arrows,
> and I was further confused why (B) had two "out arrows". Would still
> recommend these being 1a and 1b, 2a/b, 3a/b.
>
> Warren Parad
>
> Founder, CTO
> Secure your user data and complete your authorization architecture.
> Implement Authress <https://bit.ly/37SSO1p>.
>
>
> On Thu, Jul 30, 2020 at 7:24 PM Dick Hardt <[e-mail]> wrote:
>
>> The (A), (B), and (C) label the same flow that bounces through the
>> User-Agent. See note below the diagram.
>>
>> Note the tails and arrows at each end of (A) and (C), and the arrows at
>> both ends of (B) to indicate an interaction between the RO and the AS. (in
>> my original version, I had the User instead of the RO).
>>
>> The (A) and (C) flows are shown to go through the User-Agent to make it
>> clear it is a redirect flow in contrast to (D) and (E) in which the Client
>> directly talks to the AS.
>>
>>
>> ᐧ
>>
>> On Thu, Jul 30, 2020 at 9:57 AM Warren Parad <[e-mail]> wrote:
>>
>>> From the OAuth RFC, these were actually letters. I don't see a necessary
>>> association between the left side of the diagram and the right side, it
>>> just seems unnecessarily confusing.
>>> [image: image.png]
>>>
>>> Warren Parad
>>>
>>> Founder, CTO
>>> Secure your user data and complete your authorization architecture.
>>> Implement Authress <https://bit.ly/37SSO1p>.
>>>
>>>
>>> On Thu, Jul 30, 2020 at 5:49 PM Aaron Parecki <[e-mail]> wrote:
>>>
>>>> These numbers in the diagram correspond to the numbered steps in the
>>>> paragraphs below the diagram. Perhaps using non-duplicated numbers would
>>>> help, such as "1a" and "1b" instead of two instances of "1"? Although I'm
>>>> not sure how that would work exactly because the "1/2/3" are really just a
>>>> single action as described by the "Note" below the diagram in your
>>>> screenshot.
>>>>
>>>> ---
>>>> Aaron Parecki
>>>> https://aaronparecki.com
>>>> https://oauth2simplified.com
>>>>
>>>> On Thu, Jul 30, 2020 at 8:43 AM Warren Parad <[e-mail]> wrote:
>>>>
>>>>>
>>>>> https://www.ietf.org/id/draft-ietf-oauth-v2-1-00.html#name-authorization-code-grant
>>>>>
>>>>> Can we avoid using (1, 2, 3) on the left side of the diagram to
>>>>> describe, I'm not even sure what they are supposed to represent, not to
>>>>> mention the RO in the diagram doesn't really provide value (for me)
>>>>> relevant to the code grant flow. It's confusing to see these numerical
>>>>> identifiers twice in the same picture. But maybe there is something hidden
>>>>> in this that I'm missing, still 3a and 3b could be used to identify
>>>>> different legs of the same code path.
>>>>> [image: image.png]
>>>>>
>>>>>
>>>>> *Warren Parad*
>>>>> Secure your user data and complete your authorization architecture.
>>>>> Implement Authress <https://bit..ly/37SSO1p>.
>>>>> <https://rhosys.ch>
>>>>> _______________________________________________
>>>>> OAuth mailing list
>>>>> [e-mail]
>>>>> https://www.ietf.org/mailman/listinfo/oauth
>>>>>
>>>> _______________________________________________
>>> OAuth mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/oauth
>>>
>>