Re: [OAUTH-WG] AD Review of draft-ietf-oauth-introspection-07

[Justin Richer <[e-mail]>]

Kathleen,

Thanks for the update. How would we best handle this situation, since 
it's really referring to additional information that's outside the scope 
of the interoperable core? Since we're not specifying what the data is, 
we're not really in a position to say what the concerns are in a 
concrete manner. I'm thinking a sentence or two like this in the privacy 
considerations section:

    If the protected resource sends additional information about the
    client's request to the authorization server using an extension of
    this specification, such as the client's IP address or other
    information, such information could have have additional privacy
    considerations.



-- Justin

On 4/19/2015 7:01 PM, Kathleen Moriarty wrote:
> Hello,
>
> Thank you for your work on draft-ietf-oauth-introspection-07.  The 
> security considerations appear to be addressed well and I was glad to 
> see how a response is handled when the response code is false, to not 
> reveal information as to why.
>
> The privacy considerations look good, but I do have another question 
> that should be addressed in the draft in regard to privacy.
>
> Section 2.1 says an IP address (or something else) might be used to 
> provide context of the query, the authorization server could have 
> other information about the client.  It would be good to mention 
> privacy related considerations for the client in this case in addition 
> to what gets returned in the Introspection Response (already covered).
>
> Thank you.
>
>
> -- 
>
> Best regards,
> Kathleen
>
>
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth