Re: [OAUTH-WG] 'Scope' parameter proposal

I'm getting whiplash. :)  Some of us are working on UMA implementations based on the ever-changing OAuth substrate, and just discussed being glad we could reuse OAuth's advertisement of these two endpoints rather than inventing our own mechanism. If it goes, I guess we'll have to go back to defining a way to indicate it in Authz Manager (~AS) hostmeta so that the Host (~Resource Server) can pick it up and tell the Requester (~Client) where to go.

FWIW,

	Eve

On 22 Apr 2010, at 12:35 PM, Brian Eaton wrote:

> On Thu, Apr 22, 2010 at 12:07 PM, Eran Hammer-Lahav <eran@hueniverse.com> wrote:
>> If we are not going to enable a client to access a protected resource hosted by an unfamiliar
>> server, we need to stop pretending this (alone) is about interop. In other words, if we take
>> this approach we are mandating paperwork to make the protocol work, at least based
>> on this single specification. We can also drop advertising the authorization and token
>> endpoints in a 401 or really *any* parameter in a WWW-Authenticate response.
> 
> I think dropping the advertisements is the right thing to do.
> 
> I'm hopeful that either PoCo or the IMAP SASL/OAuth work ends up
> showing how automatic interop is possible.
> 
> But I'd hate to have OAuth2 recommend something that doesn't actually work.
> 
> Cheers,
> Brian
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth

Eve Maler
eve@xmlgrrl.com
http://www.xmlgrrl.com/blog