Re: [OAUTH-WG] Product Support for RFC8414 well-known URIs

[Vladimir Dzhuvinov <[e-mail]>]

On 08/06/2020 12:15, Daniel Fett wrote:
> That would be the safe implementation, but I was wondering if
> prescribing this is a good choice for an ecosystem.

Postfix vs infix:

If we reason about the common ways ASes (as web apps) get deployed, then
(perhaps) it will become obvious which method is the most natural and
likely to be taken.

  * For an AS which gets deployed in a dedicated host, e.g. as
    as.example.com , the app root is likely to be
    https://as.example.com/ and hence the config URL becoming a simple
    postfix.

  * Multi-tenant ASes where each AS has a dedicated domain for each
    issuer also.

  * For an AS which gets deployed as part of some larger app (e.g. as
    module or package) on the same host, the AS is likely to end up at
    some path like https://example.com/as/ and hence the config being
    easier for a postfix URL.

  * Multi-tenant ASes which share a domain - this is not clear, but I
    suppose both postfix and infix can be made to work without the one
    method demanding more effort.


The infix is not natural, IMO, given the way apps get deployed. Postfix
seems more natural.

I may be wrong about these assumptions. But that's one good way to
approach the problem and specify something which implementers actually
find easier / natural. This, to me, is what an "ideal" technical
standard is.

Vladimir