From: "Lu, Hui-Lan (Huilan)" <huilan.lu@alcatel-lucent.com>
To: "Lu, Hui-Lan (Huilan)" <huilan.lu@alcatel-lucent.com>,
 "'Eran Hammer-Lahav'" <eran@hueniverse.com>,
 Brian Campbell <bcampbell@pingidentity.com>
Date: Thu, 18 Aug 2011 17:13:40 -0500
Thread-Topic: [OAUTH-WG] treatment of client_id for authentication and
 identification
Thread-Index: AcxNWiAmwaoXWhpRRLSIm3Z69CEQXANudKkQALSSvmAAAWgcIAABDUFQAADlC2A=
Message-ID: <0E96A74B7DFCF844A9BE2A0BBE2C425F058F244275@USNAVSXCHMBSB3.ndc.alcatel-lucent.com>
References: <4E317125.7080006@lodderstedt.net>
 <CA56CA21.1758B%eran@hueniverse.com>
 <CA+k3eCTguAGGC1xGuuA0Z2sRu7MNCdtsUnb-3V9vmz4CFwxBYw@mail.gmail.com>
 <90C41DD21FB7C64BB94121FBBC2E7234502498CDD9@P3PW5EX1MB01.EX1.SECURESERVER.NET>
 <0E96A74B7DFCF844A9BE2A0BBE2C425F058F244272@USNAVSXCHMBSB3.ndc.alcatel-lucent.com>
 <90C41DD21FB7C64BB94121FBBC2E72345029DFAB5D@P3PW5EX1MB01.EX1.SECURESERVER.NET>
 <0E96A74B7DFCF844A9BE2A0BBE2C425F058F244274@USNAVSXCHMBSB3.ndc.alcatel-lucent.com>
In-Reply-To: <0E96A74B7DFCF844A9BE2A0BBE2C425F058F244274@USNAVSXCHMBSB3.ndc.alcatel-lucent.com>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: oauth <oauth@ietf.org>
Subject: Re: [OAUTH-WG] treatment of client_id for authentication and
 identification
Precedence: list

I just noticed that some words were missing in my previous post. Here is th=
e full text that Eran requested:

Allowing unauthenticated access to the token endpoint by public clients has=
 security ramifications. So does
issuing refresh tokens to public clients. Such security ramifications MUST =
be considered. See section 10 for further details.

Huilan


> -----Original Message-----
> From: oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf Of=
 Lu,
> Hui-Lan (Huilan)
> Sent: Thursday, August 18, 2011 5:47 PM
> To: 'Eran Hammer-Lahav'; Brian Campbell
> Cc: oauth
> Subject: Re: [OAUTH-WG] treatment of client_id for authentication and ide=
ntification
>=20
> > > It is difficult to parse the last sentence of 3.2.1: "The security ra=
mifications of
> > > allowing unauthenticated access by public clients to the token endpoi=
nt
> > > MUST be considered, as well as the issuance of refresh tokens to publ=
ic
> > > clients, their scope, and lifetime."
> > >
> > > I think it should be rewritten and reference relevant parts of securi=
ty
> > > considerations.
> >
> > Text?
> >
> > EHL
>=20
> Here is my stab:
> Allowing unauthenticated access by public clients has security ramificati=
ons. So does
> the issuance of refresh tokens to public clients. Such security ramificat=
ions MUST be
> considered. See section 10 for further details.
>=20
> Huilan
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth