Re: [OAUTH-WG] Fwd: New Version Notification for draft-lodderstedt-oauth-par-01.txt

[Vladimir Dzhuvinov <[e-mail]>]

+1 for WG adoption

I'm super pleased with how usable the spec already is and how easy it
was to explain to developers - you just take the regular authZ request
and POST it form-encoded, using whatever client auth is registered for
the token endpoint. PAR is significantly more versatile than the
original "request object endpoint" from FAPI, while keeping normative
stuff minimal by relying on existing specs - RFC 6749 and JAR. This
means existing OAuth clients and servers can be made to support it with
relatively little work because code reuse is facilitated.

The OAuth SDK was updated from PAR -00 to PAR -01 this morning to allow
for the authZ error codes:

https://www.javadoc.io/doc/com.nimbusds/oauth2-oidc-sdk/6.18/com/nimbusds/oauth2/sdk/PushedAuthorizationRequest.html

https://www.javadoc.io/doc/com.nimbusds/oauth2-oidc-sdk/6.18/com/nimbusds/oauth2/sdk/PushedAuthorizationResponse.html


Vladimir


On 03/11/2019 18:11, Torsten Lodderstedt wrote:
> Hi all, 
>
> revision of draft-lodderstedt-oauth-par (Pushed Authorization
> Requests) was just published. 
>
> Here is the list of changes:
>
>   * List client_id as one of the basic parameters
>   * Explicitly forbid request_uri in the processing rules
>   * Clarification regarding client authentication and that public
>     clients are allowed
>   * Added option to let clients register per-authorization request
>     redirect URIs
>   * General clean up and wording improvements
>
> I will present this draft in Singapore and would be happy if the
> working group would consider adoption of this joint work (Co-authors:
> David Tonge, Nat Sakimura, Brian Campbell, Filip Skokan) as WG draft.
>
> best regards,
> Torsten. 
>
>> Begin forwarded message:
>>
>> *From: *[e-mail] <mailto:[e-mail]>
>> *Subject: **New Version Notification for
>> draft-lodderstedt-oauth-par-01.txt*
>> *Date: *3. November 2019 at 17:04:23 CET
>> *To: *"Nat Sakimura" <[e-mail] <mailto:[e-mail]>>,
>> "Brian Campbell" <[e-mail]
>> <mailto:[e-mail]>>, "Torsten Lodderstedt"
>> <[e-mail] <mailto:[e-mail]>>, "Dave
>> Tonge" <[e-mail] <mailto:[e-mail]>>, "Filip Skokan"
>> <[e-mail] <mailto:[e-mail]>>
>>
>>
>> A new version of I-D, draft-lodderstedt-oauth-par-01.txt
>> has been successfully submitted by Torsten Lodderstedt and posted to the
>> IETF repository.
>>
>> Name:draft-lodderstedt-oauth-par
>> Revision:01
>> Title:OAuth 2.0 Pushed Authorization Requests
>> Document date:2019-11-02
>> Group:Individual Submission
>> Pages:14
>> URL:
>>            https://www.ietf.org/internet-drafts/draft-lodderstedt-oauth-par-01.txt
>> Status:
>>         https://datatracker.ietf.org/doc/draft-lodderstedt-oauth-par/
>> Htmlized:
>>       https://tools.ietf.org/html/draft-lodderstedt-oauth-par-01
>> Htmlized:
>>       https://datatracker.ietf.org/doc/html/draft-lodderstedt-oauth-par
>> Diff:
>>           https://www.ietf.org/rfcdiff?url2=draft-lodderstedt-oauth-par-01
>>
>> Abstract:
>>   This document defines the pushed authorization request endpoint,
>>   which allows clients to push the payload of an OAuth 2.0
>>   authorization request to the authorization server via a direct
>>   request and provides them with a request URI that is used as
>>   reference to the data in a subsequent authorization request.
>>
>>
>>
>>
>> Please note that it may take a couple of minutes from the time of
>> submission
>> until the htmlized version and diff are available at tools.ietf.org
>> <http://tools.ietf.org>.
>>
>> The IETF Secretariat
>>
>
>
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth