Re: [OAUTH-WG] Refresh Tokens

Many APIs in practice have a method such as "/me" or "/profile" for
applications to retrieve the profile information of the resource owner given
their access token. IMO this is a completely appropriate use of OAuth, even
though the resource owner is no longer anonymous in this case. I agree that
it's implementation specific.

My understanding was that OAuth is designed to give limited, revokable,
and/or temporary access to a third party without revealing the resource
owner's credentials. This has nothing to do with anonymity.

Also this is not unique to refresh tokens, the same applies to access
tokens.

Aaron Parecki

On Fri, Aug 12, 2011 at 8:10 AM, Torsten Lodderstedt <
torsten@lodderstedt.net> wrote:

> OAuth allows a client to access user resources without revealing the
> resource owner's identity to the client. Isn't this anonymity? I consider
> this an important property of the protocol.
>
> regards,
> Torsten.
>
>
>
> On Thu, 11 Aug 2011 21:00:54 -0400, Barry Leiba wrote:
>
>> This seems to need a chair to step in.  Tony is taking a strong stand
>> and maintaining it:
>>
>> On Thu, Aug 11, 2011 at 1:40 PM, Anthony Nadalin
>> <tonynad@microsoft.com> wrote:
>>
>>> Nowhere in the specification is there explanation for refresh tokens, The
>>> reason that the Refresh token was introduced was for anonymity. The
>>> scenario
>>> is that a client asks the user for access. The user wants to grant the
>>> access but not tell the client the user's identity. By issuing the
>>> refresh
>>> token as an 'identifier' for the user (as well as other context data like
>>> the resource) it's possible now to let the client get access without
>>> revealing anything about the user. Recommend that the above explanation
>>> be
>>> included so developers understand why the refresh tokens are there.
>>>
>>
>> So far, though it's been only half a day, I've seen several posts
>> disagreeing with Tony, and none supporting any change to the text for
>> this.  We're close to ending WGLC, so please post here if you agree
>> with Tony's suggested change.  Otherwise, it looks like consensus is
>> against.
>>
>> Barry, as chair
>> ______________________________**_________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/**listinfo/oauth<https://www.ietf.org/mailman/listinfo/oauth>
>>
>
> ______________________________**_________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/**listinfo/oauth<https://www.ietf.org/mailman/listinfo/oauth>
>