Re: [OAUTH-WG] Fwd: New Version Notification for draft-hunt-oauth-v2-user-a4c-01.txt

Hi Phil,

A have a question, re:

"The authorization server MUST:

  -Perform the normal OAuth2 authorization process,
  -MAY elect not to request consent if no access token is to be
       issued (i.e. this is an authentication only request),
"

This last statement confuses me, given that the Authentication Response
"is identical to the one described in Section 4.1.2 [RFC6749]."

In other words, the client may only request the login but get the 'code' 
back without the user consent ? This seems wrong but may be I'm missing 
something ?

Thanks, Sergey

>
> On 2013-08-27, at 12:52 PM, Phil Hunt <phil.hunt@oracle.com
> <mailto:phil.hunt@oracle.com>> wrote:
>
>> FYI.  Based on feedback from Berlin, Tony and I have revised the draft
>> to include:
>>
>> * Alignment with OpenID Connect (using id_token)
>> * Always returns a JWT
>> * Minimum assertion level on request
>> * Return information about the type of authentication performed
>>
>> Thanks for your input.
>>
>> Phil
>>
>> @independentid
>> www.independentid.com <http://www.independentid.com/>
>> phil.hunt@oracle.com <mailto:phil.hunt@oracle.com>
>>
>>
>> Begin forwarded message:
>>
>>> *From: *internet-drafts@ietf.org <mailto:internet-drafts@ietf.org>
>>> *Subject: **New Version Notification for
>>> draft-hunt-oauth-v2-user-a4c-01.txt*
>>> *Date: *27 August, 2013 8:56:45 AM PDT
>>> *To: *Phil Hunt <phil.hunt@yahoo.com <mailto:phil.hunt@yahoo.com>>,
>>> Anthony Nadalin <tonynad@microsoft.com
>>> <mailto:tonynad@microsoft.com>>, Tony Nadalin <tonynad@microsoft.com
>>> <mailto:tonynad@microsoft.com>>
>>>
>>>
>>> A new version of I-D, draft-hunt-oauth-v2-user-a4c-01.txt
>>> has been successfully submitted by Phil Hunt and posted to the
>>> IETF repository.
>>>
>>> Filename:draft-hunt-oauth-v2-user-a4c
>>> Revision:01
>>> Title:OAuth 2.0 User Authentication and Consent For Clients
>>> Creation date:2013-08-27
>>> Group:Individual Submission
>>> Number of pages: 10
>>> URL:
>>> http://www.ietf.org/internet-drafts/draft-hunt-oauth-v2-user-a4c-01.txt
>>> Status: http://datatracker.ietf.org/doc/draft-hunt-oauth-v2-user-a4c
>>> Htmlized: http://tools.ietf.org/html/draft-hunt-oauth-v2-user-a4c-01
>>> Diff: http://www.ietf.org/rfcdiff?url2=draft-hunt-oauth-v2-user-a4c-01
>>>
>>> Abstract:
>>>   This specification defines a new OAuth2 endpoint that enables user
>>>   authentication session and consent information to be shared with
>>>   client applications.
>>>
>>>
>>>
>>>
>>> Please note that it may take a couple of minutes from the time of
>>> submission
>>> until the htmlized version and diff are available at tools.ietf.org
>>> <http://tools.ietf.org/>.
>>>
>>> The IETF Secretariat
>>>
>>
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org <mailto:OAuth@ietf.org>
>> https://www.ietf.org/mailman/listinfo/oauth
>
>
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listi