MIME-Version: 1.0
References: <BD2D90C8-B629-4955-A22C-6E80E6390EEE@mit.edu>
In-Reply-To: <BD2D90C8-B629-4955-A22C-6E80E6390EEE@mit.edu>
From: Aaron Parecki <aaron@parecki.com>
Date: Fri, 19 Jul 2019 19:02:49 -0500
Message-ID: <CAGBSGjr+kfiavvzhPDF2SaBLDAjusoOGjvgTA85FadM+s_2u=A@mail.gmail.com>
To: Justin Richer <jricher@mit.edu>
Cc: oauth <oauth@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000f16999058e119169"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/NxQZEswEIiYS56bvrp_ejHHeycQ>
Subject: Re: [OAUTH-WG] Transaction Authorization
Precedence: list

--000000000000f16999058e119169
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi all, I'm looking forward to the discussion on this on Tuesday!

I wanted to add my thoughts on a potential addition to this draft,
specifically around returning some minimal user information in the
transaction response.

The summary of the suggestion is to return a new "user" key along with the
access token that contains the user ID and userinfo endpoint, such as:

    {
      "access_token": {
        "value": "UM1P9PMHKUR64TB8N6BW7OZB8CDFONP219RP1LT0",
        "type": "bearer"
      },
      "user": {
        "id": "5035678642",
        "userinfo": "https://authorization-server.com/user/5035678642"
      }
    }

A more detailed analysis of the specific proposal and motivation behind
this is available on my blog:

https://aaronparecki.com/2019/07/18/17/adding-identity-to-xyz

Thanks!

----
Aaron Parecki
aaronparecki.com
@aaronpk <http://twitter.com/aaronpk>



On Tue, Jul 9, 2019 at 2:48 PM Justin Richer <jricher@mit.edu> wrote:

> I have requested time to present Transactional Authorization (the XYZ
> project) at the Montreal meeting in a couple weeks. Ahead of that, I=E2=
=80=99ve
> uploaded a new version of the spec:
>
> https://tools.ietf.org/html/draft-richer-transactional-authz-02
>
> Additionally, I=E2=80=99ve updated the writeup and examples on https://oa=
uth.xyz/
>
> I plan to be in Montreal for the whole week, and I=E2=80=99ve requested f=
rom the
> chairs that I present during the Tuesday session due to limited
> availability of some key WG members on Friday.
>
> =E2=80=94 Justin
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>

--000000000000f16999058e119169
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi all, I&#39;m looking forward to the discussion on this =
on Tuesday!<div><br></div><div>I wanted to add my thoughts on a potential a=
ddition to this draft, specifically around returning some minimal user info=
rmation in the transaction response.</div><div><br></div><div>The summary o=
f the suggestion is to return a new &quot;user&quot; key along with the acc=
ess token that contains the user ID and userinfo endpoint, such as:</div><d=
iv><br></div><div>=C2=A0 =C2=A0 {<br>=C2=A0 =C2=A0=C2=A0=C2=A0 &quot;access=
_token&quot;: {<br>=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0 &quot;value&quot;: &quo=
t;UM1P9PMHKUR64TB8N6BW7OZB8CDFONP219RP1LT0&quot;,<br>=C2=A0 =C2=A0=C2=A0=C2=
=A0 =C2=A0 &quot;type&quot;: &quot;bearer&quot;<br>=C2=A0 =C2=A0=C2=A0=C2=
=A0 },<br>=C2=A0 =C2=A0=C2=A0=C2=A0 &quot;user&quot;: {<br>=C2=A0 =C2=A0=C2=
=A0=C2=A0 =C2=A0 &quot;id&quot;: &quot;5035678642&quot;,<br>=C2=A0 =C2=A0=
=C2=A0=C2=A0 =C2=A0 &quot;userinfo&quot;: &quot;<a href=3D"https://authoriz=
ation-server.com/user/5035678642">https://authorization-server.com/user/503=
5678642</a>&quot;<br>=C2=A0 =C2=A0=C2=A0=C2=A0 }<br>=C2=A0 =C2=A0=C2=A0}<br=
><div><br></div><div>A more detailed analysis of the specific proposal and =
motivation behind this is available on my blog:</div><div><br></div><div><a=
 href=3D"https://aaronparecki.com/2019/07/18/17/adding-identity-to-xyz">htt=
ps://aaronparecki.com/2019/07/18/17/adding-identity-to-xyz</a><br></div><di=
v><br></div><div>Thanks!</div><div><br clear=3D"all"><div><div dir=3D"ltr" =
class=3D"gmail_signature" data-smartmail=3D"gmail_signature"><div>----</div=
><div>Aaron Parecki</div><div><a href=3D"http://aaronparecki.com" target=3D=
"_blank">aaronparecki.com</a></div><div><a href=3D"http://twitter.com/aaron=
pk" target=3D"_blank">@aaronpk</a></div><div><br></div></div></div><br></di=
v></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmai=
l_attr">On Tue, Jul 9, 2019 at 2:48 PM Justin Richer &lt;<a href=3D"mailto:=
jricher@mit.edu">jricher@mit.edu</a>&gt; wrote:<br></div><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex">



<div style=3D"overflow-wrap: break-word;">
I have requested time to present Transactional Authorization (the XYZ proje=
ct) at the Montreal meeting in a couple weeks. Ahead of that, I=E2=80=99ve =
uploaded a new version of the spec:
<div><br>
</div>
<div><a href=3D"https://tools.ietf.org/html/draft-richer-transactional-auth=
z-02" target=3D"_blank">https://tools.ietf.org/html/draft-richer-transactio=
nal-authz-02</a></div>
<div><br>
</div>
<div>Additionally, I=E2=80=99ve updated the writeup and examples on <a href=
=3D"https://oauth.xyz/" target=3D"_blank">
https://oauth.xyz/</a>=C2=A0</div>
<div><br>
</div>
<div>I plan to be in Montreal for the whole week, and I=E2=80=99ve requeste=
d from the chairs that I present during the Tuesday session due to limited =
availability of some key WG members on Friday.=C2=A0</div>
<div><br>
<div>
<div style=3D"color:rgb(0,0,0);font-family:Helvetica;font-size:12px;font-st=
yle:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:norma=
l;text-align:start;text-indent:0px;text-transform:none;white-space:normal;w=
ord-spacing:0px;text-decoration:none">
=E2=80=94 Justin</div>
</div>
<br>
</div>
</div>

_______________________________________________<br>
OAuth mailing list<br>
<a href=3D"mailto:OAuth@ietf.org" target=3D"_blank">OAuth@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/oauth" rel=3D"noreferrer" =
target=3D"_blank">https://www.ietf.org/mailman/listinfo/oauth</a><br>
</blockquote></div>

--000000000000f16999058e119169--