Return-Path: X-Original-To: oauth@core3.amsl.com Delivered-To: oauth@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 035CA28C11B for ; Tue, 15 Jun 2010 06:58:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.525 X-Spam-Level: X-Spam-Status: No, score=-1.525 tagged_above=-999 required=5 tests=[AWL=1.073, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m-CXi0D1S2He for ; Tue, 15 Jun 2010 06:58:44 -0700 (PDT) Received: from mail-gy0-f172.google.com (mail-gy0-f172.google.com [209.85.160.172]) by core3.amsl.com (Postfix) with ESMTP id DA0C73A67D6 for ; Tue, 15 Jun 2010 06:58:43 -0700 (PDT) Received: by gyh4 with SMTP id 4so3340157gyh.31 for ; Tue, 15 Jun 2010 06:58:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type; bh=PDfHoC3rBx53/eVq8mRwcCIVKv/dZnga5c+pdFElbgA=; b=ErppFtxw286cmWmsvUWwCfQer64hewKWqpBIBq4i27vITt78lBaULb5ooh+e9QhCB9 l0ZuA3iBUFwQMDeIYoxEhQrWiOzknmF4jo5MEMMyuim9Er7O3Lw69Vn3SJf8r0Brb3jm 7Sx10F/TYvoJPT7mF5MpBR60WB3B+b5bSwLdo= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=sP1Jv8qIfLggVTjePgWXjVlAJi0XYSLcwu49EuuvI1IEPcJ8AzY0eZpDknTWZGydjm 0qdMpBDbiZ9ynjN8bDU+OqHr9pIW2nf8kC6V4KbbQ4ylGIJzptd25l1HCsx9X3UjoS9x kw2H/IKoFGKe27QxmknSf0IVx3qEzJ6YPEcEw= MIME-Version: 1.0 Received: by 10.150.167.22 with SMTP id p22mr8560231ybe.382.1276610325392; Tue, 15 Jun 2010 06:58:45 -0700 (PDT) Received: by 10.151.26.19 with HTTP; Tue, 15 Jun 2010 06:58:45 -0700 (PDT) In-Reply-To: <7F00C2CF-E57F-4341-BBA4-7B03B69277D6@gmail.com> References: <7F00C2CF-E57F-4341-BBA4-7B03B69277D6@gmail.com> Date: Tue, 15 Jun 2010 06:58:45 -0700 Message-ID: From: Andrew Arnott To: Dick Hardt Content-Type: multipart/alternative; boundary=000e0cd5c4b0f62d5c04891200c4 Cc: "OAuth WG \(oauth@ietf.org\)" Subject: Re: [OAUTH-WG] Assertion flow: please add optional refresh_token in response X-BeenThere: oauth@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: OAUTH WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Jun 2010 13:58:45 -0000 --000e0cd5c4b0f62d5c04891200c4 Content-Type: text/plain; charset=ISO-8859-1 Well it's easy enough for me to just make up a profile that follows rules I set. But since I don't think this need will be unique to myself, would you like me to write up a spec somewhere? (I've never written an IETF spec before) -- Andrew Arnott "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre On Mon, Jun 14, 2010 at 11:00 PM, Dick Hardt wrote: > +1 > > On 2010-06-14, at 9:02 PM, Brian Eaton wrote: > > > On Mon, Jun 14, 2010 at 8:31 PM, Andrew Arnott > wrote: > >> For an application I'm building, the installed client app will have > >> intermittent windows of time where it can obtain a (non-OAuth) assertion > for > >> user identity. During this time, it seems appropriate for it to use the > >> assertion flow to obtain an OAuth authorization so that it can > impersonate > >> the user. So far this is just standard Assertion Flow stuff. But > without a > >> refresh_token, the app will break when the access token expires if the > app > >> doesn't have the ability at the moment (due to not being on the > corporate > >> network at the moment for example) to obtain a new assertion. Since the > >> security model for this app would certainly allow for a refresh_token to > be > >> issued from the original OAuth authorization server exchange, this would > >> solve it, if the spec didn't specifically ban such a parameter. > > > > I think this is a different use case than the one envisioned by most > > people who are using the assertion flow. > > > > I'm inclined to steer different use cases to different profiles. It > > makes it much easier to guide deployments, for example. > > > > Cheers, > > Brian > > _______________________________________________ > > OAuth mailing list > > OAuth@ietf.org > > https://www.ietf.org/mailman/listinfo/oauth > > --000e0cd5c4b0f62d5c04891200c4 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Well it's easy enough for me to just make up a profile that follows rul= es I set.=A0 But since I don't think this need will be unique to myself= , would you like me to write up a spec somewhere? (I've never written a= n IETF spec before)
--
Andrew Arnott
"I [may] not agree with what you have to say, b= ut I'll defend to the death your right to say it." - S. G. Tallent= yre


On Mon, Jun 14, 2010 at 11:00 PM, Dick H= ardt <dick.har= dt@gmail.com> wrote:
+1

On 2010-06-14, at 9:02 PM, Brian Eaton wrote:

> On Mon, Jun 14, 2010 at 8:31 PM, Andrew Arnott <andrewarnott@gmail.com> wrote:
>> For an application I'm building, the installed client app will= have
>> intermittent windows of time where it can obtain a (non-OAuth) ass= ertion for
>> user identity. =A0During this time, it seems appropriate for it to= use the
>> assertion flow to obtain an OAuth authorization so that it can imp= ersonate
>> the user. =A0So far this is just standard Assertion Flow stuff. = =A0But without a
>> refresh_token, the app will break when the access token expires if= the app
>> doesn't have the ability at the moment (due to not being on th= e corporate
>> network at the moment for example) to obtain a new assertion. =A0S= ince the
>> security model for this app would certainly allow for a refresh_to= ken to be
>> issued from the original OAuth authorization server exchange, this= would
>> solve it, if the spec didn't specifically ban such a parameter= .
>
> I think this is a different use case than the one envisioned by most > people who are using the assertion flow.
>
> I'm inclined to steer different use cases to different profiles. = =A0It
> makes it much easier to guide deployments, for example.
>
> Cheers,
> Brian
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth


--000e0cd5c4b0f62d5c04891200c4--