IETF Logo Mail Archive

Re: [OAUTH-WG] Access Token Response without expires_in

"Richer, Justin P." <jricher@mitre.org> Tue, 17 January 2012 18:59 UTC

Return-Path: <jricher@mitre.org>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D6E511E80AA; Tue, 17 Jan 2012 10:59:32 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.598
X-Spam-Level:
X-Spam-Status: No, score=-6.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bsfSGdD9w8Lk; Tue, 17 Jan 2012 10:59:31 -0800 (PST)
Received: from smtpksrv1.mitre.org (smtpksrv1.mitre.org [198.49.146.77]) by ietfa.amsl.com (Postfix) with ESMTP id 82E8D11E80A6; Tue, 17 Jan 2012 10:59:31 -0800 (PST)
Received: from smtpksrv1.mitre.org (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id F25D721B17B3; Tue, 17 Jan 2012 13:59:30 -0500 (EST)
Received: from IMCCAS01.MITRE.ORG (imccas01.mitre.org [129.83.29.78]) by smtpksrv1.mitre.org (Postfix) with ESMTP id DDA4421B17A5; Tue, 17 Jan 2012 13:59:30 -0500 (EST)
Received: from IMCMBX01.MITRE.ORG ([169.254.1.158]) by IMCCAS01.MITRE.ORG ([129.83.29.78]) with mapi id 14.01.0339.001; Tue, 17 Jan 2012 13:59:30 -0500
From: "Richer, Justin P." <jricher@mitre.org>
To: Torsten Lodderstedt <torsten@lodderstedt.net>, Paul Madsen <paul.madsen@gmail.com>
Thread-Topic: AW: Re: [OAUTH-WG] Access Token Response without expires_in
Thread-Index: AczUf8kvUkdgy1nHSGOm5KixWQExDAAclWSAABTAkIAABtE5gAAAVTyAAAFYhID//8HxSQ==
Date: Tue, 17 Jan 2012 18:59:30 +0000
Message-ID: <B33BFB58CCC8BE4998958016839DE27E09EC78@IMCMBX01.MITRE.ORG>
References: <90C41DD21FB7C64BB94121FBBC2E723453A754C549@P3PW5EX1MB01.EX1.SECURESERVER.NET> <E4309A9E-9BC7-4547-918A-224B6233B25C@mitre.org> <4F157659.7050701@gmail.com> <1451834425-1326818330-cardhu_decombobulator_blackberry.rim.net-253428785-@b4.c11.bise7.blackberry> <4F15A655.4060404@gmail.com>, <2fc6806a-8a15-4b97-87f2-3c0c0cbd3623@email.android.com>
In-Reply-To: <2fc6806a-8a15-4b97-87f2-3c0c0cbd3623@email.android.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [129.83.31.52]
Content-Type: multipart/alternative; boundary="_000_B33BFB58CCC8BE4998958016839DE27E09EC78IMCMBX01MITREORG_"
MIME-Version: 1.0
Cc: "oauth-bounces@ietf.org" <oauth-bounces@ietf.org>, OAuth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Access Token Response without expires_in
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 17 Jan 2012 18:59:32 -0000

By the same argument, the client can know how long the tokens are good for via API description. What we're talking about is a programmatic hint by the AS to the Client about what the token is good for. One common use is time-limited, and so provisions for that have been baked in so that everybody does it the same way. If there's enough out there to be use-limited or other bits, we should have a tiny provision to extend this in a similar fashion.

 -- Justin

________________________________
From: Torsten Lodderstedt [torsten@lodderstedt.net]
Sent: Tuesday, January 17, 2012 12:26 PM
To: Paul Madsen
Cc: oauth-bounces@ietf.org; Richer, Justin P.; OAuth WG
Subject: Re: AW: Re: [OAUTH-WG] Access Token Response without expires_in

Hi Paul,

that's not what I meant. The Client should know which tokens should be one time usage based on the API description. The authz server must not return expires_in because this would not make any sense in this case.

regards,
Torsten




Paul Madsen <paul.madsen@gmail.com> schrieb:
Hi Torsten, yes the use case in question is payment-based as well.

Your suggestion for the client to infer one-time usage from a missing expires_in contradicts the general consensus of this thread does it not?

paul

On 1/17/12 11:38 AM, torsten@lodderstedt.net<mailto:torsten@lodderstedt.net> wrote:

Hi,

isn't one-time semantics typically associated with certain requests on certain resources/resource types. I therefore would assume the client to know which tokens to use one-time only. The authz server should not return an expires_in paramter. We for example use one time access tokens for payment transactions.

What would such an extension specify?

regards,
Torsten.
Gesendet mit BlackBerry® Webmail von Telekom Deutschland

-----Original Message-----
From: Paul Madsen <paul.madsen@gmail.com><mailto:paul.madsen@gmail.com>
Sender: oauth-bounces@ietf.org<mailto:oauth-bounces@ietf.org>
Date: Tue, 17 Jan 2012 08:23:37
To: Richer, Justin P.<jricher@mitre.org><mailto:jricher@mitre.org>
Cc: OAuth WG<oauth@ietf.org><mailto:oauth@ietf.org>
Subject: Re: [OAUTH-WG] Access Token Response without expires_in

_______________________________________________
OAuth mailing list
OAuth@ietf.org<mailto:OAuth@ietf.org>
https://www.ietf.org/mailman/listinfo/oauth

v2.23.0 | Report a Bug | By Email