[OAUTH-WG] device profile comments

[Brian Eaton <[e-mail]>]

I'm going through the April 21 draft and making notes...  Most of them
are of the "what color should the bike shed be" variety, but I think
the device profile needs real changes.

The verification URI has to be short and memorable, because users have
to type it.

Different devices are probably going to end up needing different
verification URIs, for branding reasons.  (For example, the approval
page should say “link your Google account to your Foo device”)

Different devices are probably going to need different callback URLs.
In usability studies on desktop apps [1] we found that it was
important that users be told what to do after they had clicked "OK".
We dealt with that by finding ways for desktop apps to receive
callback URLs.  For apps which can't open a web browser [2], it seems
likely that we're going to want to give users instructions on what to
do next.  It really helps to give users a clue that they should go
back to the device that requested approval.

So I’d propose changing the profile as follows:

- Client requests device code by sending type=device and client_id=<id>

- Authorization server doesn’t return approval URL - device hard-codes
this instead.
   I expect that this will point to a manufacturer specific page, and
that the manufacturer specific page will automatically redirect to a
page on the authorization server.

- Approval URL MUST have client_id, and MAY have callback.
   I expect that the client_id will be used to brand the approval
page, and that the callback will point to a manufacturer specific
completion page.

Plus a few comments on error codes:

“End User Authorization Pending or Expired” - authorization server
probably isn’t going to be able to tell whether a code has expired, or
was never issued.  Probably just return “unknown_code”.

The “slow_down” error probably merits an “interval”.  Maybe always
return “interval” with authorization_pending, and eliminate the
slow_down error code entirely?

Cheers,
Brian

[1] http://sites.google.com/site/oauthgoog/UXFedLogin/desktopapps
[2] http://sites.google.com/site/oauthgoog/UXFedLogin/nobrowser