IETF Logo Mail Archive

Re: [OAUTH-WG] 'Scope' parameter proposal

Luke Shepard <lshepard@facebook.com> Sat, 01 May 2010 22:50 UTC

Return-Path: <lshepard@facebook.com>
X-Original-To: oauth@core3.amsl.com
Delivered-To: oauth@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 087633A68AD for <oauth@core3.amsl.com>; Sat, 1 May 2010 15:50:40 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.005
X-Spam-Level:
X-Spam-Status: No, score=-3.005 tagged_above=-999 required=5 tests=[AWL=0.260, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q-1sR-x+ZiT6 for <oauth@core3.amsl.com>; Sat, 1 May 2010 15:50:39 -0700 (PDT)
Received: from mailout-snc1.facebook.com (mailout-snc1.facebook.com [69.63.179.25]) by core3.amsl.com (Postfix) with ESMTP id 33D4F3A679C for <oauth@ietf.org>; Sat, 1 May 2010 15:50:37 -0700 (PDT)
Received: from mail.thefacebook.com ([192.168.18.105]) by pp01.snc1.tfbnw.net (8.14.3/8.14.3) with ESMTP id o41Mnvi7018669 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NOT); Sat, 1 May 2010 15:49:57 -0700
Received: from sc-hub06.TheFacebook.com (192.168.18.83) by sc-hub02.TheFacebook.com (192.168.18.105) with Microsoft SMTP Server (TLS) id 8.2.213.0; Sat, 1 May 2010 15:50:15 -0700
Received: from SC-MBXC1.TheFacebook.com ([192.168.18.102]) by sc-hub06.TheFacebook.com ([192.168.18.83]) with mapi; Sat, 1 May 2010 15:50:15 -0700
From: Luke Shepard <lshepard@facebook.com>
To: Brian Eaton <beaton@google.com>
Date: Sat, 01 May 2010 15:50:13 -0700
Thread-Topic: [OAUTH-WG] 'Scope' parameter proposal
Thread-Index: AcrpgKlMcO/7oXXaR4ytjHt4lNN7tg==
Message-ID: <01DBC6A5-681A-4B14-87D7-A59D8F351A8E@facebook.com>
References: <C7F1D1FC.32809%eran@hueniverse.com> <0D5497F5-75A7-4A42-9A5E-9C2310162B18@jkemp.net> <90C41DD21FB7C64BB94121FBBC2E723438E5C7F30A@P3PW5EX1MB01.EX1.SECURESERVER.NET> <g2mdaf5b9571004221036j5d6837f6z4d7959d69a3cbb2b@mail.gmail.com> <BB02FD4F-071E-4FF5-B3D0-F8D3FA22FEEE@jkemp.net> <90C41DD21FB7C64BB94121FBBC2E723438E5C7FD26@P3PW5EX1MB01.EX1.SECURESERVER.NET> <h2ldaf5b9571004221235tb844eb6ah623955979526c1b6@mail.gmail.com> <90C41DD21FB7C64BB94121FBBC2E723438E5C7FD4A@P3PW5EX1MB01.EX1.SECURESERVER.NET> <l2idaf5b9571004221350oa0dbeb11ndeb4cb9147407ba9@mail.gmail.com> <255B9BB34FB7D647A506DC292726F6E1125793664B@WSMSG3153V.srv.dir.telstra.com> <w2sdaf5b9571004231705jbff1ae6dz70fd966f091502b3@mail.gmail.com>
In-Reply-To: <w2sdaf5b9571004231705jbff1ae6dz70fd966f091502b3@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Proofpoint-Virus-Version: vendor=fsecure engine=1.12.8161:2.4.5, 1.2.40, 4.0.166 definitions=2010-05-01_02:2010-02-06, 2010-05-01, 2010-04-30 signatures=0
Cc: OAuth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] 'Scope' parameter proposal
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 01 May 2010 22:50:40 -0000

I'm intrigued by the idea of returning scopes in the 403 response to a resource.

I'll see if we can provide a working example of it.

On Apr 23, 2010, at 5:05 PM, Brian Eaton wrote:

> On Thu, Apr 22, 2010 at 6:11 PM, Manger, James H
> <James.H.Manger@team.telstra.com> wrote:
>> We mustn't drop advertisements (details in 401 responses).
>> We mustn't drop the goal of a standard for interoperability.
> 
> I share the goals, I just don't think that a specification is the way
> to get there.  I think working examples in the wild would help
> enormously.
> 
>> Defining a scope field in a 401 response is the novel aspect that “might not actually work”. Allowing a 'scope' query parameter in authz URIs is be quite separate.
> 
> Yeah, I agree with that analysis.
> 
> Though I don't know of any providers that are returning authorization
> URLs in 401 responses right now.  That's novel, too.
> 
> Cheers,
> Brian
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth

v2.23.0 | Report a Bug | By Email