Re: [OAUTH-WG] Authorization Code Grant diagram Improvement OAuth 2.1 draft-ietf-oauth-v2-1

Warren Parad <wparad@rhosys.ch> Thu, 30 July 2020 16:57 UTC

Return-Path: <wparad@rhosys.ch>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D7F7B3A0DF1 for <oauth@ietfa.amsl.com>; Thu, 30 Jul 2020 09:57:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.087
X-Spam-Level:
X-Spam-Status: No, score=-2.087 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_IMAGE_RATIO_04=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=rhosys.ch
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IlD7B561BmHz for <oauth@ietfa.amsl.com>; Thu, 30 Jul 2020 09:57:42 -0700 (PDT)
Received: from mail-qv1-xf31.google.com (mail-qv1-xf31.google.com [IPv6:2607:f8b0:4864:20::f31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 891B13A0DED for <oauth@ietf.org>; Thu, 30 Jul 2020 09:57:42 -0700 (PDT)
Received: by mail-qv1-xf31.google.com with SMTP id x6so6999977qvr.8 for <oauth@ietf.org>; Thu, 30 Jul 2020 09:57:42 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rhosys.ch; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ePMQhyMkk0gS9QOah7UCZXMk3CObrPn/x4zt93m1jLQ=; b=eJ6zXQ1vfz0ffYA/jU5JL0vfksFmWnVMjEdqTF5gXAgoWnim6AqmzUs79ZLCCJJpg0 Cv2R0cns+19fRIfBCq95cJDpkqGv9UpbwZ/yHU3C7Nr2AvYHUcWdDDs/XC0EzV7HC7JF sDIrQxlZx3NtlVxhgBZqcaKyHDOaTu/PIejrY=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ePMQhyMkk0gS9QOah7UCZXMk3CObrPn/x4zt93m1jLQ=; b=PiVngfUMVpGUA4TeobiSX5mi3+qoacdZ9qdJi0RryV7jojQDjrtF2itcOuOX1GqWQP jjIlFSymMiazzCYP/lD+2WefzinWb/mf68cyRoXtTgy9rfli6wy/TIBi6++7OSTQ6paF SDPp2O8+EXWZUzN57HcyaY/ufbxGo6ZgNzVseIQ21W2dkGSRrVMq06upw+RjqAo/IeMD hdJRrg7Fne5WpiZmTxpl/KgUuqtknSXAtEDuF3hS/0T5pXNP2HDiME+Sj7MtYl0X6jFk akuhyXZPgLfWbHZPP54p56D6fwH166+DUJnBSewAqTsKzMt9KYcBpCwQPeuhGx9g0Xd7 6+pQ==
X-Gm-Message-State: AOAM53288Jn+ppHJhpSww5WPmE9nikyIG5I8CaETosOirmG7yjlQsz3G 6bKIvTMSN6OdOys1BBJretcEXK3vCtNyBAc55hkgp/VHw3hE
X-Google-Smtp-Source: ABdhPJxSKmjcINyi1V/RPeHz5J2XhG/DG9QM4byW648pIU9gucq5oDZQbr7/2PmndB0I2c1L2EmVkDzndi698C+jmIQ=
X-Received: by 2002:a0c:ac4c:: with SMTP id m12mr17540qvb.218.1596128260906; Thu, 30 Jul 2020 09:57:40 -0700 (PDT)
MIME-Version: 1.0
References: <CAJot-L0pNWox1aX5GOkD=QVJakRVVtn=PvysciB2Wak6ijG+Dw@mail.gmail.com> <CAGBSGjo_w5+fOE0bQeeiuQLt0-Xkt+Gdu01C3BHZeuOZNh4Taw@mail.gmail.com>
In-Reply-To: <CAGBSGjo_w5+fOE0bQeeiuQLt0-Xkt+Gdu01C3BHZeuOZNh4Taw@mail.gmail.com>
From: Warren Parad <wparad@rhosys.ch>
Date: Thu, 30 Jul 2020 18:57:29 +0200
Message-ID: <CAJot-L0XmQ2wbmXPDjhwT4tT8nihmEXxc-N3orfeV21EKyYCPA@mail.gmail.com>
To: Aaron Parecki <aaron@parecki.com>
Cc: oauth <oauth@ietf.org>
Content-Type: multipart/related; boundary="00000000000002492b05abab923c"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/Hz-3ewvMnDLwc7ZXpgBMUv9r2JU>
Subject: Re: [OAUTH-WG] Authorization Code Grant diagram Improvement OAuth 2.1 draft-ietf-oauth-v2-1
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 30 Jul 2020 16:57:45 -0000

>From the OAuth RFC, these were actually letters. I don't see a necessary
association between the left side of the diagram and the right side, it
just seems unnecessarily confusing.
[image: image.png]

Warren Parad

Founder, CTO
Secure your user data and complete your authorization architecture.
Implement Authress <https://bit.ly/37SSO1p>.


On Thu, Jul 30, 2020 at 5:49 PM Aaron Parecki <aaron@parecki.com> wrote:

> These numbers in the diagram correspond to the numbered steps in the
> paragraphs below the diagram. Perhaps using non-duplicated numbers would
> help, such as "1a" and "1b" instead of two instances of "1"? Although I'm
> not sure how that would work exactly because the "1/2/3" are really just a
> single action as described by the "Note" below the diagram in your
> screenshot.
>
> ---
> Aaron Parecki
> https://aaronparecki.com
> https://oauth2simplified.com
>
> On Thu, Jul 30, 2020 at 8:43 AM Warren Parad <wparad@rhosys.ch> wrote:
>
>>
>> https://www.ietf.org/id/draft-ietf-oauth-v2-1-00.html#name-authorization-code-grant
>>
>> Can we avoid using (1, 2, 3) on the left side of the diagram to describe,
>> I'm not even sure what they are supposed to represent, not to mention the
>> RO in the diagram doesn't really provide value (for me) relevant to the
>> code grant flow. It's confusing to see these numerical identifiers twice in
>> the same picture. But maybe there is something hidden in this that I'm
>> missing, still 3a and 3b could be used to identify different legs of the
>> same code path.
>> [image: image.png]
>>
>>
>> *Warren Parad*
>> Secure your user data and complete your authorization architecture.
>> Implement Authress <https://bit..ly/37SSO1p>.
>> <https://rhosys.ch>
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
>>
>