Re: [OAUTH-WG] draft-ietf-oauth-v2-22

Eran Hammer-Lahav <eran@hueniverse.com> Wed, 19 October 2011 03:38 UTC

From: Eran Hammer-Lahav <eran@hueniverse.com>
To: qijun83 <qijun83@gmail.com>
Date: Tue, 18 Oct 2011 20:38:25 -0700
Thread-Topic: draft-ietf-oauth-v2-22
Thread-Index: AcyOEJKbeeFMgKOVSOyPSGRuIqW8PQ==
Message-ID: <AD5D14C6-DB18-4163-86C5-441956EC6617@hueniverse.com>
References: <CAPRM5o2=uwXdNdhHMr3=vKi+7bHXDfyg0V7uZ0ZrBLTSJKgcew@mail.gmail.com>
In-Reply-To: <CAPRM5o2=uwXdNdhHMr3=vKi+7bHXDfyg0V7uZ0ZrBLTSJKgcew@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: multipart/alternative; boundary="_000_AD5D14C6DB18416386C5441956EC6617hueniversecom_"
MIME-Version: 1.0
Cc: OAuth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-22
Precedence: list

Sending to the right place.

On Oct 18, 2011, at 20:36, "qijun83" <qijun83@gmail.com<mailto:qijun83@gmail.com>> wrote:

Dear Sir,

It's really very pleasure for me to write to you for asking some questions about oauth-v2-22 as follows.

In section 2.3 (Client Authentication), it is recommended to use the HTTP Basic authentication scheme
like "Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW", which is included of "user_id" and
"password" as defined in [RFC2617<http://tools.ietf.org/html/rfc2617>], instead of using the parameters of "client_id" and "client_secret" in
HTTP request body.
I want to know,
(1). whether "user_id" equals to "client_id", and "password" equals to "client_secret".
(2). and whether it is allowed to use both of the  HTTP Basic authentication scheme and the client
credentials in the request body at the same time.

Looking forward to hearing from you.

Yours, sincerely
Qijun Zhang

Re: [OAUTH-WG] draft-ietf-oauth-v2-22 Eran Hammer-Lahav