Message-ID: <4F3936AF.90402@mitre.org>
Date: Mon, 13 Feb 2012 11:13:35 -0500
From: Justin Richer <jricher@mitre.org>
User-Agent: Mozilla/5.0 (X11; Linux i686;
 rv:10.0) Gecko/20120129 Thunderbird/10.0
MIME-Version: 1.0
To: Andrew Arnott <andrewarnott@gmail.com>
References: <CAE358b4yTtRXqsz-p+o_F=cj4a-JChWvn8RJ-j169ckQaq6sEw@mail.gmail.com>
In-Reply-To: <CAE358b4yTtRXqsz-p+o_F=cj4a-JChWvn8RJ-j169ckQaq6sEw@mail.gmail.com>
Content-Type: multipart/alternative;
 boundary="------------050609050907030902070608"
Cc: "OAuth WG \(oauth@ietf.org\)" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Clarification on section 3.3: missing scope parameter
 in access token request
Precedence: list

--------------050609050907030902070608
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit

In most cases, it will likely be a fixed value, but there's nothing 
indicating that it can't be contextual. Especially in cases where you've 
got public, confidential, and dynamically-registered clients all acting 
on the same host, the default value will depend completely on what kind 
of client is asking.

Really, this is a way of saying "scope is up to the AS", which it is, 
even if the client asks for something else.

  -- Justin

On 02/12/2012 11:44 PM, Andrew Arnott wrote:
> From section 3.3 (draft 23):
>
>     If the client omits the scope parameter when requesting
>     authorization, the authorization server MUST either process the
>     request using*a pre-defined default value*, or fail the request
>     indicating an invalid scope. The authorization server SHOULD
>     document its scope requirements and default value (if defined). 
>
>
> Is this saying that the pre-defined default value must be a FIXED 
> value for all clients and all grants?  Or might the predefined default 
> value actually be a derivation of the grant? (for example, by default 
> the access token scope is simply the maximum scope allowed by the grant)
>
> Thanks.
>
> --
> Andrew Arnott
> "I [may] not agree with what you have to say, but I'll defend to the 
> death your right to say it." - S. G. Tallentyre
>
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth


--------------050609050907030902070608
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit

<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    In most cases, it will likely be a fixed value, but there's nothing
    indicating that it can't be contextual. Especially in cases where
    you've got public, confidential, and dynamically-registered clients
    all acting on the same host, the default value will depend
    completely on what kind of client is asking.<br>
    <br>
    Really, this is a way of saying "scope is up to the AS", which it
    is, even if the client asks for something else.<br>
    <br>
    &nbsp;-- Justin<br>
    <br>
    On 02/12/2012 11:44 PM, Andrew Arnott wrote:
    <blockquote
cite="mid:CAE358b4yTtRXqsz-p+o_F=cj4a-JChWvn8RJ-j169ckQaq6sEw@mail.gmail.com"
      type="cite">
      <meta http-equiv="Content-Type" content="text/html;
        charset=ISO-8859-1">
      <div>From section 3.3 (draft 23):</div>
      <blockquote class="gmail_quote"
style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span
style="font-family:verdana,charcoal,helvetica,arial,sans-serif;background-color:rgb(255,255,255)">If
          the client omits the scope parameter when requesting
          authorization, the authorization server MUST either process
          the request using<b> a pre-defined default value</b>, or fail
          the request indicating an invalid scope. The authorization
          server SHOULD document its scope requirements and default
          value (if defined).</span>
      </blockquote>
      <div><br>
      </div>
      <div>Is this saying that the pre-defined default value must be a
        FIXED value for all clients and all grants? &nbsp;Or might the
        predefined default value actually be a derivation of the grant?
        (for example, by default the access token scope is simply the
        maximum scope allowed by the grant)</div>
      <div><br>
      </div>
      <div>Thanks.</div>
      <br clear="all">
      --<br>
      Andrew Arnott<br>
      "I [may] not agree with what you have to say, but I'll defend to
      the death your right to say it." - S. G. Tallentyre<br>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
OAuth mailing list
<a class="moz-txt-link-abbreviated" href="mailto:OAuth@ietf.org">OAuth@ietf.org</a>
<a class="moz-txt-link-freetext" href="https://www.ietf.org/mailman/listinfo/oauth">https://www.ietf.org/mailman/listinfo/oauth</a>
</pre>
    </blockquote>
    <br>
  </body>
</html>

--------------050609050907030902070608--