IETF Logo Mail Archive

Re: [OAUTH-WG] Device Code expiration and syntax

Justin Richer <jricher@mit.edu> Thu, 16 March 2017 14:06 UTC

Return-Path: <jricher@mit.edu>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9E5D1294CC for <oauth@ietfa.amsl.com>; Thu, 16 Mar 2017 07:06:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.221
X-Spam-Level:
X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XV8lh79OZIE3 for <oauth@ietfa.amsl.com>; Thu, 16 Mar 2017 07:06:00 -0700 (PDT)
Received: from dmz-mailsec-scanner-5.mit.edu (dmz-mailsec-scanner-5.mit.edu [18.7.68.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 18F1A1294F5 for <oauth@ietf.org>; Thu, 16 Mar 2017 07:05:56 -0700 (PDT)
X-AuditID: 12074422-567ff70000005d34-38-58ca9bc19f53
Received: from mailhub-auth-3.mit.edu ( [18.9.21.43]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id D3.C0.23860.1CB9AC85; Thu, 16 Mar 2017 10:05:54 -0400 (EDT)
Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-3.mit.edu (8.13.8/8.9.2) with ESMTP id v2GE5rTC017920; Thu, 16 Mar 2017 10:05:53 -0400
Received: from [192.168.128.57] (static-96-237-195-53.bstnma.fios.verizon.net [96.237.195.53]) (authenticated bits=0) (User authenticated as jricher@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id v2GE5pop000525 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Thu, 16 Mar 2017 10:05:52 -0400
To: William Denniss <wdenniss@google.com>, John Bradley <ve7jtb@ve7jtb.com>
References: <AEE72C0E-6FFA-4BE5-87EB-D2EBF891211E@mit.edu> <CAAP42hBAaAMf0ojSBYL55O1GiUZ4Hx2Z43jRoWZqsm6=HVCVNQ@mail.gmail.com> <0CAB3A6D-5B80-41DF-9499-35D21D98F7B7@mit.edu> <CAAP42hCUBKt=cHRQ8jKETRzmLxZsnKbxthtSE=xmXhLpGkH+rg@mail.gmail.com> <CA+k3eCRsF6cdzypnV8a0hpqRDLetgKBC++EjLqQ5u_c5b17tfw@mail.gmail.com> <69CC44FD-27B3-40DD-8D8A-B3D18D09B804@ve7jtb.com> <CAAP42hB+S418Y-hQ7WPYtwcXpV-0Wm8hqLjoj5DiBNsGKf8bBQ@mail.gmail.com>
Cc: "<oauth@ietf.org>" <oauth@ietf.org>
From: Justin Richer <jricher@mit.edu>
Message-ID: <dbc722a9-900d-9c76-cfba-08886b937a50@mit.edu>
Date: Thu, 16 Mar 2017 10:05:49 -0400
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0
MIME-Version: 1.0
In-Reply-To: <CAAP42hB+S418Y-hQ7WPYtwcXpV-0Wm8hqLjoj5DiBNsGKf8bBQ@mail.gmail.com>
Content-Type: multipart/alternative; boundary="------------523DA4D015E9EB04CF647EFA"
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprFKsWRmVeSWpSXmKPExsUixCmqrXto9qkIg1+bDCxOvn3FZrH67l82 i01zmtkdmD0WbCr1WLLkJ5PH7dsbWQKYo7hsUlJzMstSi/TtErgydtyZxlLQXlGx4cpZpgbG u8ZdjJwcEgImEuu7G5i6GLk4hATamCRu9vSyQjgbGSVePdkElbnNJPFp314WkBZhAUuJNTem gdkiAt4SX+79ZIYo2s0s8XDdCiCHg4NZQF2i/aQLSA2bgKrE9DUtTCA2r4CVxJoJrxhBbBag +Lzfd9lBbFGBGImWJR8YIWoEJU7OfAI2n1MgUOLF4fdgcWaBMIkbLX+ZJzDyz0JSNgtJCsK2 lbgzdzeULS/RvHU2lK0rsWjbCnZk8QWMbKsYZVNyq3RzEzNzilOTdYuTE/PyUot0TfVyM0v0 UlNKNzGCgp3dRWkH48R/XocYBTgYlXh4X/ifjBBiTSwrrsw9xCjJwaQkyqtlfipCiC8pP6Uy I7E4I76oNCe1+BCjBAezkghvHDDGhHhTEiurUovyYVLSHCxK4rziGo0RQgLpiSWp2ampBalF MFkZDg4lCd6QWUCNgkWp6akVaZk5JQhpJg5OkOE8QMOzQGp4iwsSc4sz0yHypxh1ORb92/2G SYglLz8vVUqct2cmUJEASFFGaR7cHFCSSnh72PQVozjQW8K870FG8QATHNykV0BLmICWvP1w AmRJSSJCSqqBUXwD2/pj6maFIcdOvHhbGPr7a9yfHNkL/yPuf+vPzqmNu9syS3Jio4SyrEH2 srPPpkQUTP2U1svn9SxoQxTH355HN5R8e1eEP2adcesBk9i+De170z/fFw4z2uaTpdUht1hh c2Nb2QpN5Z2nEmML3kzWtF+S9dnK0S794NToB30n+ydsPB0Uo8RSnJFoqMVcVJwIAPvK/EIt AwAA
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/JRqjCZMEIaLT_PYLUl2SLUAXlhY>
Subject: Re: [OAUTH-WG] Device Code expiration and syntax
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 16 Mar 2017 14:06:02 -0000

Funny thing, I went to remove it from our implementation, and we were 
already ignoring it completely.

Also, our implementation was just pushed to the master branch and will 
be in the next release: 
https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/

  -- Justin


On 3/15/2017 7:18 PM, William Denniss wrote:
> Yes, I think this bled over from the original spec.
>
> Google's Device endpoint doesn't use a response_type param.
>
> It's removed in -05.
>
> On Wed, Mar 15, 2017 at 4:15 PM, John Bradley <ve7jtb@ve7jtb.com 
> <mailto:ve7jtb@ve7jtb.com>> wrote:
>
>     I think response mode is only needed if you are overloading a
>     existing authorization endpoint.
>
>     URI are cheep so I don’t see the value.
>
>
>
>>     On Mar 13, 2017, at 8:47 AM, Brian Campbell
>>     <bcampbell@pingidentity.com <mailto:bcampbell@pingidentity.com>>
>>     wrote:
>>
>>
>>
>>     On Sat, Mar 11, 2017 at 1:54 PM, William Denniss
>>     <wdenniss@google.com <mailto:wdenniss@google.com>> wrote:
>>
>>
>>         On Sat, Mar 11, 2017 at 12:40 PM, Justin Richer
>>         <jricher@mit.edu <mailto:jricher@mit.edu>> wrote:
>>
>>
>>>
>>>                 Secondly, I had a question about the “response_type”
>>>                 parameter to the device endpoint. This parameter is
>>>                 required and it has a single, required value, with
>>>                 no registry or other possibility of extension.
>>>                 What’s the point? If it’s for “parallelism”, I’ll
>>>                 note that this is *not* the authorization endpoint
>>>                 (as the user is not present) and such constraints
>>>                 need not apply here.
>>>
>>>
>>>             Good points here. At a guess, it bled in from the OAuth
>>>             spec. If it's not needed, we should remove it.
>>>
>>
>>             I’d vote for removal, I don’t see the point.
>>
>>
>>     +1 on removal of the “response_type” parameter from the Device
>>     Authorization Request
>>
>>
>>     _______________________________________________
>>     OAuth mailing list
>>     OAuth@ietf.org <mailto:OAuth@ietf.org>
>>     https://www.ietf.org/mailman/listinfo/oauth
>>     <https://www.ietf.org/mailman/listinfo/oauth>
>
>
>
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth

v2.23.0 | Report a Bug | By Email