Re: [OAUTH-WG] OAuth 2.1: dropping password grant

+1 to drop ROPC from the Security BCP, as it is not the best current
practice.

Speaking generally, the argument that people are currently using it and
will need to change, therefore we shouldn't deprecate anything is actually
antithetical to the goals of a BCP. As has been pointed out, they can
ignore the BCP should they wish and keep doing what they are doing. Really
the question should be: is this the right way to do this? I believe the
answer to that is "no", particularly when reading the original text in RFC
6749 Section 1.3.3 that we're essentially striking out here. If people are
doing different things with this grant type, then that's probably worthy of
it's own grant type.

As you wrote earlier Niel "There are better grant types for this - e.g. JWT
bearer - but they are a bit harder to implement.". Perhaps we can document
the better practice for this use-case to help point people using ROPC for
this in the right direction. Regarding the "harder to implement" concern, I
also don't think that's a reason for not deprecating. When I wrote RFC 8252
everyone was doing native app authorization in web views, and would need to
change what they were doing to adopt the BCP which was actually a lot of
work (but, for the reasons documented, it was really important to change).
This was actually why I wrote that BCP... to justify and help drive that
necessary change.

On Mon, Feb 24, 2020 at 6:49 AM Neil Madden <neil.madden@forgerock.com>
wrote:

> Well, kinda. People can still theoretically use OAuth 1 too, but the world
> has moved on - software has dropped support for it, websites don’t support
> it, and so on.
>
> I’m a bit confused about what OAuth 2.1 is intended to be. If it’s not a
> new version of OAuth (“obsoletes” the old RFC), then is not just another
> BCP? If it is a new version and it removes grant types (OAuth 3.0?) then
> that effectively has the same impact as removing them from OAuth 2.0,
> unless we’re envisioning some way for a client to negotiate version 2.0
> support from an AS?
>
> — Neil
>
> > On 22 Feb 2020, at 01:41, Dick Hardt <dick.hardt@gmail.com> wrote:
> >
> > I'm a little confused on where this thread is going. If we take ROPC out
> of OAuth 2.1 then:
> >
> > 1) Existing deployments can keep using ROPC - why break it if it is
> working.
> >
> > 2) New deployments can use ROPC and be OAuth 2.0 compliant.
> >
> > 3) New deployments that don't need ROPC can be OAuth 2.1 compliant
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>