Re: [OAUTH-WG] [Technical Errata Reported] RFC7662 (7607)

[Justin Richer <[e-mail]>]

I don’t think it’s necessary to enumerate all of the possible parties that could have had a hand in revoking the token — it have also been revoked by the AS through some backend process or through administrative action. If a token is revoked, it’s revoked — and the RS doesn’t generally care why or who did it, just that the token is no good. It doesn’t hurt to list the client here, but it’s not necessary. As such, I still say the errata should be rejected.

 — Justin

On Aug 19, 2023, at 6:32 PM, Fulong Sun <[e-mail]> wrote:

Hi Justin,

Yes, the resource owner can revoke, but the client also can revoke the token, why do not write both of them?

孙福龙
Fulong Sun

东软教育科技集团・IDC
IDC of Neusoft Education Technology Group

Office: [phone] / 6602
Mobile: [phone]
E-mail: [e-mail]<mailto:[e-mail]>
Address: Room 305, Building A5, No. 8, Software Park Road, Dalian, Liaoning, China

From: Justin Richer <[e-mail]>
Sent: 2023年8月18日 20:54
To: RFC Errata System <[e-mail]>; [e-mail]; [e-mail]; [e-mail]; [e-mail]; [e-mail]
Cc: [e-mail]; [e-mail]
Subject: Re: [OAUTH-WG] [Technical Errata Reported] RFC7662 (7607)

The resource owner can revoke the token out of band, this errata should be rejected.

- Justin
________________________________
From: OAuth <[e-mail]<mailto:[e-mail]>> on behalf of RFC Errata System <[e-mail]<mailto:[e-mail]>>
Sent: Thursday, August 17, 2023 2:42 PM
To: [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]><[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]><[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]><[e-mail]<mailto:[e-mail]>>
Subject: [OAUTH-WG] [Technical Errata Reported] RFC7662 (7607)

The following errata report has been submitted for RFC7662,
"OAuth 2.0 Token Introspection".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid7607

--------------------------------------
Type: Technical
Reported by: Fulong Sun <[e-mail]<mailto:[e-mail]>>

Section: 2.2

Original Text
-------------
a given token has been issued by this authorization server, has not been revoked by the resource owner, and is within its given time window of validity

Corrected Text
--------------
a given token has been issued by this authorization server, has not been revoked by the resource owner or client, and is within its given time window of validity

Notes
-----
RFC 7009 defined a given token can be revoke by client, so should write client here.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party
can log in to change the status and edit the report, if necessary.

--------------------------------------
RFC7662 (draft-ietf-oauth-introspection-11)
--------------------------------------
Title               : OAuth 2.0 Token Introspection
Publication Date    : October 2015
Author(s)           : J. Richer, Ed.
Category            : PROPOSED STANDARD
Source              : Web Authorization Protocol
Area                : Security
Stream              : IETF
Verifying Party     : IESG

_______________________________________________
OAuth mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/oauth