IETF Logo Mail Archive

Re: [OAUTH-WG] Open Issues: Group Survey (respond by 5/13)

Torsten Lodderstedt <torsten@lodderstedt.net> Tue, 11 May 2010 15:53 UTC

Return-Path: <torsten@lodderstedt.net>
X-Original-To: oauth@core3.amsl.com
Delivered-To: oauth@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 86C223A69E8 for <oauth@core3.amsl.com>; Tue, 11 May 2010 08:53:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.481
X-Spam-Level:
X-Spam-Status: No, score=-0.481 tagged_above=-999 required=5 tests=[AWL=-0.646, BAYES_40=-0.185, HELO_EQ_DE=0.35]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dHFsJCW+UACJ for <oauth@core3.amsl.com>; Tue, 11 May 2010 08:53:57 -0700 (PDT)
Received: from smtprelay03.ispgateway.de (smtprelay03.ispgateway.de [80.67.31.37]) by core3.amsl.com (Postfix) with ESMTP id B8DF33A67AE for <oauth@ietf.org>; Tue, 11 May 2010 08:53:57 -0700 (PDT)
Received: from p4fff1096.dip.t-dialin.net ([79.255.16.150] helo=[127.0.0.1]) by smtprelay03.ispgateway.de with esmtpa (Exim 4.68) (envelope-from <torsten@lodderstedt.net>) id 1OBrmD-0003jt-Eb; Tue, 11 May 2010 17:53:45 +0200
Message-ID: <4BE97D7F.7020303@lodderstedt.net>
Date: Tue, 11 May 2010 17:53:35 +0200
From: Torsten Lodderstedt <torsten@lodderstedt.net>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; de; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4
MIME-Version: 1.0
To: Vivek Khurana <hiddenharmony@gmail.com>
References: <Acrvu4cfH3LKPgwRQV+7sW5YxUA1vA==> <90C41DD21FB7C64BB94121FBBC2E72343B3AB46E1C@P3PW5EX1MB01.EX1.SECURESERVER.NET> <AANLkTik1NKqjCuquccqCMWV2RDQdqcdHpKnRQtwc7L4v@mail.gmail.com>
In-Reply-To: <AANLkTik1NKqjCuquccqCMWV2RDQdqcdHpKnRQtwc7L4v@mail.gmail.com>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
X-Df-Sender: 141509
Cc: "OAuth WG (oauth@ietf.org)" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Open Issues: Group Survey (respond by 5/13)
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 11 May 2010 15:53:58 -0000

Am 11.05.2010 12:33, schrieb Vivek Khurana:
>> 2. Client Authentication (in flows)
>>
>> How should the client authenticate when making token requests? The current draft defines special request parameters for sending client credentials. Some have argued that this is not the correct way, and that the client should be using existing HTTP authentication schemes to accomplish that such as Basic.
>>
>> A. Client authenticates by sending its credentials using special parameters (current draft)
>> B. Client authenticated by using HTTP Basic (or other schemes supported by the server such as Digest)
>>      
>   Either of them is acceptable, but if we go with B, the specification
> should specify the charset to be used for Basic authentication.
>
> regards
> Vivek
>
>    
What about defining a new Authentication Scheme for the purpose of OAuth 
client authentication? Would this help to deal with such problems?

regards,
Torsten.

v2.23.0 | Report a Bug | By Email