[OAUTH-WG] Reconciling section 2.2 with 3.2.1

Andrew Arnott <andrewarnott@gmail.com> Mon, 13 February 2012 04:22 UTC

Return-Path: <andrewarnott@gmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost []) by ietfa.amsl.com (Postfix) with ESMTP id 53BE621F873A for <oauth@ietfa.amsl.com>; Sun, 12 Feb 2012 20:22:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.598
X-Spam-Status: No, score=-3.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id WhtNgn6yKhU1 for <oauth@ietfa.amsl.com>; Sun, 12 Feb 2012 20:22:14 -0800 (PST)
Received: from mail-qw0-f51.google.com (mail-qw0-f51.google.com []) by ietfa.amsl.com (Postfix) with ESMTP id B77EC21F8730 for <oauth@ietf.org>; Sun, 12 Feb 2012 20:22:14 -0800 (PST)
Received: by qan41 with SMTP id 41so2824048qan.10 for <oauth@ietf.org>; Sun, 12 Feb 2012 20:22:14 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:from:date:message-id:subject:to:content-type; bh=5aOqVq87I+sbhjEyT8m1bZkipExl6GKAejKTlTcJooE=; b=hicqOahS2br/rCu3x4ybr0aIHV7nYH86BS2BTAJMoRbzH6bdy4fbQcrEEaDsAyMY8e oiSfjWNecFRG5tCnofLt2TyrBMc9cLI90sj+VFkynX9RG2USma4roJxsJ7g2/0H/TB/D 7GBKpuoVcI76vtsiDLkxVF5/QZXZjFKJ4gHdI=
Received: by with SMTP id s1mr7875202qct.18.1329106934178; Sun, 12 Feb 2012 20:22:14 -0800 (PST)
MIME-Version: 1.0
Received: by with HTTP; Sun, 12 Feb 2012 20:21:54 -0800 (PST)
From: Andrew Arnott <andrewarnott@gmail.com>
Date: Sun, 12 Feb 2012 20:21:54 -0800
Message-ID: <CAE358b7FQJoP-JLUUpoWMOrQZ8oSGeM6WWEtyUtj0wbvMGNNtw@mail.gmail.com>
To: "OAuth WG (oauth@ietf.org)" <oauth@ietf.org>
Content-Type: multipart/alternative; boundary="00235452e7b0ae248504b8d0d217"
Subject: [OAUTH-WG] Reconciling section 2.2 with 3.2.1
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 13 Feb 2012 04:22:15 -0000

Can anyone please help me understand how these two sentences do not

>From section 2.2 Client Identifier

> The client identifier is not a secret, it is exposed to the resource
> owner, and *MUST NOT be used alone* for client authentication.

>From section 3.2.1 Client Authentication
> A public client that was not issued a client password MAY use the
> client_id request parameter to identify itself when sending requests to
> the token endpoint.


Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death
your right to say it." - S. G. Tallentyre