From: "Lu, Hui-Lan (Huilan)" <huilan.lu@alcatel-lucent.com>
To: "'Eran Hammer-Lahav'" <eran@hueniverse.com>,
 Brian Campbell <bcampbell@pingidentity.com>
Date: Thu, 18 Aug 2011 16:47:10 -0500
Thread-Topic: [OAUTH-WG] treatment of client_id for authentication and
 identification
Thread-Index: AcxNWiAmwaoXWhpRRLSIm3Z69CEQXANudKkQALSSvmAAAWgcIAABDUFQ
Message-ID: <0E96A74B7DFCF844A9BE2A0BBE2C425F058F244274@USNAVSXCHMBSB3.ndc.alcatel-lucent.com>
References: <4E317125.7080006@lodderstedt.net>
 <CA56CA21.1758B%eran@hueniverse.com>
 <CA+k3eCTguAGGC1xGuuA0Z2sRu7MNCdtsUnb-3V9vmz4CFwxBYw@mail.gmail.com>
 <90C41DD21FB7C64BB94121FBBC2E7234502498CDD9@P3PW5EX1MB01.EX1.SECURESERVER.NET>
 <0E96A74B7DFCF844A9BE2A0BBE2C425F058F244272@USNAVSXCHMBSB3.ndc.alcatel-lucent.com>
 <90C41DD21FB7C64BB94121FBBC2E72345029DFAB5D@P3PW5EX1MB01.EX1.SECURESERVER.NET>
In-Reply-To: <90C41DD21FB7C64BB94121FBBC2E72345029DFAB5D@P3PW5EX1MB01.EX1.SECURESERVER.NET>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: oauth <oauth@ietf.org>
Subject: Re: [OAUTH-WG] treatment of client_id for authentication and
 identification
Precedence: list

> > It is difficult to parse the last sentence of 3.2.1: "The security rami=
fications of
> > allowing unauthenticated access by public clients to the token endpoint
> > MUST be considered, as well as the issuance of refresh tokens to public
> > clients, their scope, and lifetime."
> >
> > I think it should be rewritten and reference relevant parts of security
> > considerations.
>=20
> Text?
>=20
> EHL

Here is my stab:
Allowing unauthenticated access by public clients has security ramification=
s. So does the issuance of refresh tokens to public clients. Such security =
ramifications MUST be considered. See section 10 for further details.

Huilan