DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
 h=subject:mime-version:content-type:from:in-reply-to:date:cc
 :content-transfer-encoding:message-id:references:to:x-mailer;
 b=PDVj/s+SITq/G+VeynMxk6Cpn91QIZQnUwPlDW9SdCyJ2inrL2GoZJbYgslrQVMPt+
 KQc3Sn0b48N4OAhlS1QgD1ZxWHOwKYKamuUv+zhxQOmOpYWdYC4WSv39eL9PeSjwFJBD
 2zaOaamKLOEXsRIuX/AqMHLCfA/7h+DymGdqE=
Mime-Version: 1.0 (Apple Message framework v1078)
Content-Type: text/plain; charset=us-ascii
From: Dick Hardt <dick.hardt@gmail.com>
In-Reply-To: <90C41DD21FB7C64BB94121FBBC2E72343B3EC84999@P3PW5EX1MB01.EX1.SECURESERVER.NET>
Date: Fri, 25 Jun 2010 11:22:13 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <345F0F5E-9401-4B76-98DF-FB7AF53ED0E2@gmail.com>
References: <3D3C75174CB95F42AD6BCC56E5555B4502BE07CC@FIESEXC015.nsn-intra.net>
 <90C41DD21FB7C64BB94121FBBC2E72343B3EC84973@P3PW5EX1MB01.EX1.SECURESERVER.NET>
 <B6B3E8C3-6B3B-4428-94E4-1D22A93424E6@gmail.com>
 <90C41DD21FB7C64BB94121FBBC2E72343B3EC84999@P3PW5EX1MB01.EX1.SECURESERVER.NET>
To: Eran Hammer-Lahav <eran@hueniverse.com>
Cc: "Tschofenig, Hannes \(NSN - FI/Espoo\)" <hannes.tschofenig@nsn.com>,
 OAuth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Extensibility for OAuth?
Precedence: list

Agree that if it is a different kind of function, than a new end point =
is a good thing.

I'm not understanding the review process below in your example. Would =
adding language parameters not be an extension? Would that need to be a =
change to the spec or a new spec?
.
On 2010-06-25, at 11:18 AM, Eran Hammer-Lahav wrote:

> I think the two endpoints are currently well defined. For example, the =
token endpoint always takes an access grant and turns it into an access =
token with optional refresh token. To "extend" it to say, register new =
clients dynamically, is a bad thing. But adding a new parameter (such as =
language) is a good thing to support, and by requiring review, only =
parameters that don't change the overall design will be approved.
>=20
> EHL
>=20
>> -----Original Message-----
>> From: Dick Hardt [mailto:dick.hardt@gmail.com]
>> Sent: Friday, June 25, 2010 11:13 AM
>> To: Eran Hammer-Lahav
>> Cc: Tschofenig, Hannes (NSN - FI/Espoo); OAuth WG
>> Subject: Re: [OAUTH-WG] Extensibility for OAuth?
>>=20
>> Would you elaborate on your reasons here? Do you think we have
>> enumerated all the possibilities?
>>=20
>> On 2010-06-25, at 10:59 AM, Eran Hammer-Lahav wrote:
>>=20
>>> I would rather limit the ability to extend the two endpoints beyond =
their
>> current architecture, and instead, allow others to specify new =
endpoints (e.g.
>> a device endpoint for getting an authorization code without using =
browser
>> redirection) that work in addition to the token endpoint (using an =
existing
>> grant type or assertion).
>=20