Re: [OAUTH-WG] Mail regarding draft-ietf-oauth-v2

Great suggestion Charles. I think this is a good clarification. I'll adjust the copy you sent to be what follows in a new draft published tomorrow evening (Sunday PT) unless someone objects.

-- Dick

In both sections 4.1.2.1 and 4.2.2.1:

  server_error
       The authorization server encountered an unexpected
       condition which prevented it from fulfilling the request. 
       This error code is needed because a 500 Internal Server
       Error HTTP status code cannot be returned to the client
       via a HTTP redirect.
  temporarily_unavailable
       The authorization server is currently unable to handle
       the request due to a temporary overloading or maintenance
       of the server.  This error code is needed because a 503 Service
       Unavailable HTTP status code cannot be returned to the client
       via a HTTP redirect.

On Jul 13, 2012, at 9:45 AM, Honton, Charles wrote:

> Just to make sure I understand…
> 
> If  the Authorization Server returns a 5xx,  the User-Agent will immediately display a error message.
> 
> If  the Authorization Server returns an error code in the redirect,  the Client can take alternative actions or appropriately message the error.
> 
> If this is correct, perhaps a slight change in wording will explain the lack of symmetry in the error codes. 
> 
> In both sections 4.1.2.1 and 4.2.2.1:
> 
> 	server_error
>                The authorization server encountered an unexpected
>                condition which prevented it from fulfilling the request. 
> 	       Using this error code allows the Client to handle this 
>                condition instead of the User-Agent
>          temporarily_unavailable
>                The authorization server is currently unable to handle
>                the request due to a temporary overloading or maintenance
>                of the server.  Using this error code allows the Client 
>                to handle this condition instead of the User-Agent
> 
> Thanks,
> chas
> 
> From: John Bradley <ve7jtb@ve7jtb.com>
> Date: Friday, July 13, 2012 9:08 AM
> To: Charles Honton <charles_honton@intuit.com>
> Cc: Dick Hardt <dick.hardt@gmail.com>, "draft-ietf-oauth-v2@tools.ietf.org" <draft-ietf-oauth-v2@tools.ietf.org>, "oauth@ietf.org WG" <oauth@ietf.org>
> Subject: Re: [OAUTH-WG] Mail regarding draft-ietf-oauth-v2
> 
> 4.2.2.1 and 4.1.2.1 are error codes that are returned to the client through the browser via a 302 redirect.
> 
> You can't send a 5xx error via a 302 redirect.
> 
> That is why those need error messages specific to OAuth.  
> 
> Errors not being sent via redirect use normal http error codes.
> 
> I thought that was clear.  Is there some general confusion on this?
> 
> John B.
> On 2012-07-13, at 11:55 AM, Honton, Charles wrote:
> 
>> Great! Because this question has come up multiple times, perhaps the rfc could explain the use of 5xx return code in addition to error_code.
>> 
>> I must be missing something.  Why are  server_error and temporarily_unavailable specified in sections 4.2.2.1 and 4.1.2.1?  Is there a distinction between 5xx return code and error_code in these cases?
>> 
>> Chas
>> 
>> From: John Bradley <ve7jtb@ve7jtb.com>
>> Date: Friday, July 13, 2012 4:04 AM
>> To: Dick Hardt <dick.hardt@gmail.com>
>> Cc: Charles Honton <charles_honton@intuit.com>, "draft-ietf-oauth-v2@tools.ietf.org" <draft-ietf-oauth-v2@tools.ietf.org>, "oauth@ietf.org WG" <oauth@ietf.org>
>> Subject: Re: [OAUTH-WG] Mail regarding draft-ietf-oauth-v2
>> 
>> FRom what I can see in a similar discussion Eran pointed out that this is a direct communication, communication between the client and token endpoint.
>> 
>> Server Error and temporarily unavailable are not OAuth specific and are handled by existing HTTP error codes.
>> 
>> I don't see a need for a change.
>> 
>> Unless something else dramatic comes up I would like to see draft 29 go to the RFC editor.
>> 
>> (Though one person mentioned to me that 30 is a nicer number:)
>> 
>> John B.
>> 
>> On 2012-07-12, at 8:09 PM, Dick Hardt wrote:
>> 
>>> Charles
>>> 
>>> Thanks for the suggestion. I just did publish a new draft that included a number of items that had been discussed and I would like to get some feedback on your suggestion before incorporating it (or not).
>>> 
>>> Does anyone have feedback on the change below? (+/-)
>>> 
>>> -- Dick
>>> 
>>> On Jul 12, 2012, at 1:45 PM, Honton, Charles wrote:
>>> 
>>>> E. Hammer, D. Recordon, D. Hardt, et.al,
>>>> 
>>>> I'm looking at draft 28 (http://tools.ietf.org/html/draft-ietf-oauth-v2-28).
>>>> 
>>>> In Section 5.2 the error code should probably include:
>>>> 
>>>> 	server_error
>>>>                The authorization server encountered an unexpected
>>>>                condition which prevented it from fulfilling the request.
>>>>          temporarily_unavailable
>>>>                The authorization server is currently unable to handle
>>>>                the request due to a temporary overloading or maintenance
>>>>                of the server.
>>>> 
>>>> 
>>>> Regards,
>>>> chas
>>>> 
>>> 
>>> _______________________________________________
>>> OAuth mailing list
>>> OAuth@ietf.org
>>> https://www.ietf.org/mailman/listinfo/oauth
>> 
> 