Re: [OAUTH-WG] Scope - Coming to a Consensus

Marius Scurtescu <mscurtescu@google.com> Sat, 01 May 2010 01:07 UTC

Return-Path: <mscurtescu@google.com>
X-Original-To: oauth@core3.amsl.com
Delivered-To: oauth@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1E4B63A6A01 for <oauth@core3.amsl.com>; Fri, 30 Apr 2010 18:07:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.207
X-Spam-Level:
X-Spam-Status: No, score=-105.207 tagged_above=-999 required=5 tests=[AWL=-0.719, BAYES_05=-1.11, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rdj83VpSyDFq for <oauth@core3.amsl.com>; Fri, 30 Apr 2010 18:07:42 -0700 (PDT)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 119F83A66B4 for <oauth@ietf.org>; Fri, 30 Apr 2010 18:07:41 -0700 (PDT)
Received: from kpbe14.cbf.corp.google.com (kpbe14.cbf.corp.google.com [172.25.105.78]) by smtp-out.google.com with ESMTP id o4117PM4022507 for <oauth@ietf.org>; Fri, 30 Apr 2010 18:07:26 -0700
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1272676046; bh=pkebNOT73WuUTm5Ex9SBEAS8tQ0=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=RQFNRYCWhFldYv42S+4FsHd8MZsYFCxfy0vyuXHy8q2mVeyBjCR3ZQ8rDT+wl1MW5 gMwwy2cFCAEi+IgphQGjA==
DomainKey-Signature: a=rsa-sha1; s=beta; d=google.com; c=nofws; q=dns; h=mime-version:in-reply-to:references:from:date:message-id: subject:to:cc:content-type:x-system-of-record; b=eU88iM4TvqULFCxDogWDuBG1oB8uBVM4wo1e9t5qtOllPDokagobfqZLwHJs9O42X IHJYSFBpzePywfS2Jilmg==
Received: from pwi6 (pwi6.prod.google.com [10.241.219.6]) by kpbe14.cbf.corp.google.com with ESMTP id o4117Ofd030344 for <oauth@ietf.org>; Fri, 30 Apr 2010 18:07:24 -0700
Received: by pwi6 with SMTP id 6so399491pwi.18 for <oauth@ietf.org>; Fri, 30 Apr 2010 18:07:24 -0700 (PDT)
Received: by 10.141.187.4 with SMTP id o4mr1452739rvp.217.1272676044146; Fri, 30 Apr 2010 18:07:24 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.141.14.15 with HTTP; Fri, 30 Apr 2010 18:07:04 -0700 (PDT)
In-Reply-To: <4BDB24CA.4050407@lodderstedt.net>
References: <90C41DD21FB7C64BB94121FBBC2E723439321772EF@P3PW5EX1MB01.EX1.SECURESERVER.NET> <4BDB24CA.4050407@lodderstedt.net>
From: Marius Scurtescu <mscurtescu@google.com>
Date: Fri, 30 Apr 2010 18:07:04 -0700
Message-ID: <AANLkTikGcyvdMiYKLC3TUaIVChlgwQUxJ2I8eud1ivNU@mail.gmail.com>
To: Torsten Lodderstedt <torsten@lodderstedt.net>
Content-Type: text/plain; charset=ISO-8859-1
X-System-Of-Record: true
Cc: "OAuth WG \(oauth@ietf.org\)" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Scope - Coming to a Consensus
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 01 May 2010 01:07:45 -0000

On Fri, Apr 30, 2010 at 11:43 AM, Torsten Lodderstedt
<torsten@lodderstedt.net> wrote:
> In my opinion, automatic discovery on scope values is as valuable or not
> valuable as automatic discovery for a service API. I would like to echo one
> of my postings:
>
> A scope defines the set of permissions a client asks for and that becomes
> associated with tokens. I don't see the need (and a way) for automatic scope
> discovery. In my opinion, scopes are part of the API documentation of a
> particular resource server. So if someone implements a client, it needs to
> consider the different scopes this client needs the end users authorization
> for. If the resource server implements a OAuth2-based standard API (e.g. for
> contact management or e-Mail), a client might be interoperable (in terms of
> scopes) among the resource servers implementing this standard.

Not sure I understand, are you saying that for a standard API, like
IMAP for example, there should be a standard scope (or set of scopes)?
If not, then discovery of scopes is almost a must in this case. The
client implementor cannot know the actual scope because implementation
is done against a generic API.

I did not see the value of scope discovery until I realized the above use case.

Marius