Re: [OAUTH-WG] [Technical Errata Reported] RFC8414 (7793)

[Brian Campbell <[e-mail]>]

This erratum seems legit.

On Wed, Jan 31, 2024 at 2:46 PM RFC Errata System <[e-mail]>
wrote:

> The following errata report has been submitted for RFC8414,
> "OAuth 2.0 Authorization Server Metadata".
>
> --------------------------------------
> You may review the report below and at:
> https://www.rfc-editor.org/errata/eid7793
>
> --------------------------------------
> Type: Technical
> Reported by: Kristina Yasuda <[e-mail]>
>
> Section: 2
>
> Original Text
> -------------
> response_types_supported
>       REQUIRED.  JSON array containing a list of the OAuth 2.0
>       "response_type" values that this authorization server supports.
>       The array values used are the same as those used with the
>       "response_types" parameter defined by "OAuth 2.0 Dynamic Client
>       Registration Protocol" [RFC7591].
>
> Corrected Text
> --------------
> response_types_supported
>       JSON array containing a list of the OAuth 2.0
>       "response_type" values that this authorization server supports.
>       This is REQUIRED unless no grant types are supported
>       that use the authorization endpoint. The array values used are
>       the same as those used with the "response_types" parameter defined by
>       "OAuth 2.0 Dynamic Client Registration Protocol" [RFC7591].
>
> Notes
> -----
> For the authorization servers that only support grant types that do not
> use authorization endpoint (like client credentials grant), there is no
> value to put in the required `response_types_supported` parameter. At the
> same time, section 3.2 says that "Claims with zero elements MUST be omitted
> from the response." `authorization_endpoint`parameter is already required
> for the ASs that support grant types that use the authorization endpoint,
> so it should be the same for the `response_types_supported` parameter.
>
> Instructions:
> -------------
> This erratum is currently posted as "Reported". (If it is spam, it
> will be removed shortly by the RFC Production Center.) Please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party
> will log in to change the status and edit the report, if necessary.
>
> --------------------------------------
> RFC8414 (draft-ietf-oauth-discovery-10)
> --------------------------------------
> Title               : OAuth 2.0 Authorization Server Metadata
> Publication Date    : June 2018
> Author(s)           : M. Jones, N. Sakimura, J. Bradley
> Category            : PROPOSED STANDARD
> Source              : Web Authorization Protocol
> Area                : Security
> Stream              : IETF
> Verifying Party     : IESG
>
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth
>

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._