[OAUTH-WG] [Technical Errata Reported] RFC8414 (7793)

RFC Errata System <rfc-editor@rfc-editor.org> Wed, 31 January 2024 21:46 UTC

To: mbj@microsoft.com, n-sakimura@nri.co.jp, RFC8414@ve7jtb.com, rdd@cert.org, paul.wouters@aiven.io, hannes.tschofenig@arm.com, rifaat.s.ietf@gmail.com
From: RFC Errata System <rfc-editor@rfc-editor.org>
Cc: yasudakristina@gmail.com, oauth@ietf.org, rfc-editor@rfc-editor.org
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20240131214637.731FDE7C63@rfcpa.amsl.com>
Date: Wed, 31 Jan 2024 13:46:37 -0800
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/TIUBvopXUqa8uHpQModmUkZBZoE>
Subject: [OAUTH-WG] [Technical Errata Reported] RFC8414 (7793)
Precedence: list

The following errata report has been submitted for RFC8414,
"OAuth 2.0 Authorization Server Metadata".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid7793

--------------------------------------
Type: Technical
Reported by: Kristina Yasuda <yasudakristina@gmail.com>

Section: 2

Original Text
-------------
response_types_supported
REQUIRED. JSON array containing a list of the OAuth 2.0
"response_type" values that this authorization server supports.
The array values used are the same as those used with the
"response_types" parameter defined by "OAuth 2.0 Dynamic Client
Registration Protocol" [RFC7591].

Corrected Text
--------------
response_types_supported
JSON array containing a list of the OAuth 2.0
"response_type" values that this authorization server supports.
This is REQUIRED unless no grant types are supported
that use the authorization endpoint. The array values used are
the same as those used with the "response_types" parameter defined by
"OAuth 2.0 Dynamic Client Registration Protocol" [RFC7591].

Notes
-----
For the authorization servers that only support grant types that do not use authorization endpoint (like client credentials grant), there is no value to put in the required `response_types_supported` parameter. At the same time, section 3.2 says that "Claims with zero elements MUST be omitted from the response." `authorization_endpoint`parameter is already required for the ASs that support grant types that use the authorization endpoint, so it should be the same for the `response_types_supported` parameter.

Instructions:
-------------
This erratum is currently posted as "Reported". (If it is spam, it
will be removed shortly by the RFC Production Center.) Please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party
will log in to change the status and edit the report, if necessary.

--------------------------------------
RFC8414 (draft-ietf-oauth-discovery-10)
--------------------------------------
Title : OAuth 2.0 Authorization Server Metadata
Publication Date : June 2018
Author(s) : M. Jones, N. Sakimura, J. Bradley
Category : PROPOSED STANDARD
Source : Web Authorization Protocol
Area : Security
Stream : IETF
Verifying Party : IESG

[OAUTH-WG] [Technical Errata Reported] RFC8414 (7… RFC Errata System
Re: [OAUTH-WG] [Technical Errata Reported] RFC841… Brian Campbell