Re: [OAUTH-WG] WGLC on draft-ietf-oauth-incremental-authz-01

Posting this to the list with Naveen's permission, see his comment below,
and my response:

On Thu, Nov 7, 2019 at 12:51 AM Naveen Agarwal <na@ohauth.com> wrote:

> Hi William,
>
> One nit.. on page 5 I think "requires" should be "required"
>
> "If later the user interacts with
>    the calendar or contacts features then, and only then, should the
>    require*s* scopes be requested. "
>
>
I've fixed this in my staged copy, will land in version 05.

> Separately I think it may be worth adding  somewhere (with more privacy conscious users and awareness)
>
> that if authorization server does not show currently granted scopes, then a user may assume that the current set of scopes
>
> are all they are granting to this client. Leading to privacy issues.
>
>
Thank you for your review Naveen, I appreciate your feedback.

I added a section to address this topic, "Previously Granted Scopes" (in
version 04). One challenge is that this advice can only apply to clients
that can't be impersonated (like confidential clients), as otherwise the
display could be inaccurate.

> Also a server could revalidate existing scopes and a user could deny them. A client should be able to handle that.
>
>
It would be good to guide clients on this possibility, I agree. I added a
new section "Handling Scope Reductions" (in version 04) to discuss some of
these possibilities and how they should be handled.

Regards,
William

> Thanks
>
>
> Naveen
>
>

> On Wed, Nov 6, 2019 at 5:15 PM William Denniss <wdenniss=
> 40google.com@dmarc.ietf.org> wrote:
>
>>
>> On Wed, Sep 25, 2019 at 3:54 PM Brian Campbell <bcampbell=
>> 40pingidentity.com@dmarc.ietf.org> wrote:
>>
>>> Just noticed that something is missing in
>>> https://tools.ietf.org/html/draft-ietf-oauth-incremental-authz-02#section-5
>>> where it has just, "(Section 4.1.4 of )"
>>>
>>
>> Thank you for catching this Brian. It was meant to read Section 4.1.4 of
>> RFC 6749.
>>
>> I've updated this in my local copy, will get posted in version 04.
>>
>>
>>>
>>> On Thu, Sep 12, 2019 at 8:40 AM Hannes Tschofenig <
>>> Hannes.Tschofenig@arm.com> wrote:
>>>
>>>> Thanks for the correction; yes – the most recent version is -02 and I
>>>> posted an old link.
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> *From:* Eve Maler <eve@xmlgrrl.com>
>>>> *Sent:* Donnerstag, 12. September 2019 16:16
>>>> *To:* Hannes Tschofenig <Hannes.Tschofenig@arm.com>
>>>> *Subject:* Re: [OAUTH-WG] WGLC on draft-ietf-oauth-incremental-authz-01
>>>>
>>>>
>>>>
>>>> I think you mean
>>>> https://tools.ietf.org/html/draft-ietf-oauth-incremental-authz-02?
>>>>
>>>> Eve Maler (sent from my iPad) | cell +1 425 345 6756 <(425)%20345-6756>
>>>>
>>>>
>>>> On Sep 11, 2019, at 4:22 AM, Hannes Tschofenig <
>>>> Hannes.Tschofenig@arm.com <Hannes....Tschofenig@arm.com>> wrote:
>>>>
>>>> Hi all,
>>>>
>>>>
>>>>
>>>> We are starting a WGLC on the "OAuth 2.0 Incremental Authorization"
>>>> draft. You can find the document here:
>>>>
>>>> https://tools.ietf.org/html/draft-ietf-oauth-incremental-authz-01
>>>>
>>>>
>>>>
>>>> Please review the document and provide feedback.
>>>>
>>>>
>>>>
>>>> The WGLC will end September 25th, 2019.
>>>>
>>>>
>>>>
>>>> Ciao
>>>>
>>>> Hannes & Rifaat
>>>>
>>>> IMPORTANT NOTICE: The contents of this email and any attachments are
>>>> confidential and may also be privileged. If you are not the intended
>>>> recipient, please notify the sender immediately and do not disclose the
>>>> contents to any other person, use it for any purpose, or store or copy the
>>>> information in any medium. Thank you.
>>>>
>>>> _______________________________________________
>>>> OAuth mailing list
>>>> OAuth@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/oauth
>>>>
>>>> IMPORTANT NOTICE: The contents of this email and any attachments are
>>>> confidential and may also be privileged. If you are not the intended
>>>> recipient, please notify the sender immediately and do not disclose the
>>>> contents to any other person, use it for any purpose, or store or copy the
>>>> information in any medium. Thank you.
>>>> _______________________________________________
>>>> OAuth mailing list
>>>> OAuth@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/oauth
>>>>
>>>
>>> *CONFIDENTIALITY NOTICE: This email may contain confidential and
>>> privileged material for the sole use of the intended recipient(s). Any
>>> review, use, distribution or disclosure by others is strictly
>>> prohibited....  If you have received this communication in error, please
>>> notify the sender immediately by e-mail and delete the message and any file
>>> attachments from your computer. Thank you.*
>>> _______________________________________________
>>> OAuth mailing list
>>> OAuth@ietf.org
>>> https://www.ietf.org/mailman/listinfo/oauth
>>>
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
>>
>