Re: [OAUTH-WG] Link relations for authenticating

[Evert Pot <[e-mail]>]

On 2019-05-06 2:35 p.m., Neil Madden wrote:
> I don’t know the relative merits of Link headers vs .well-known, but
> there is at least one other draft standard I know of that is going
> down the .well-known route for this kind of thing (password changes in
> this case):
>
> https://github.com/WICG/change-password-url/blob/gh-pages/explainer.md
>
> — Neil

Hi Neil,

The RFC describes this a bit:
https://tools.ietf.org/html/rfc5785#section-3

The prime use-case for me is finding domain-wide services, especially in
cases where no full context-uri exists. A great example is answering the
question: Where is the CalDAV server for a given email address. Given
that an email address only has a hostname and not a full uri,
.well-known is a good way to find related services.

But .well-known doesn't really do everything that Web Linking (rfc8288)
does, and for people like me that want to build web services and
standards on the web, creating new relationship types is really the way
to go.

They're also pretty low risk and simple to register. They just need a
stable specification, and a RFC is great for this.

I actually do intend to use this with OAuth2, because I want my resource
services to link to an oauth2 authorization endpoint via the
'authentication' link.

Evert