Re: [OAUTH-WG] Call for Adoption: OAuth 2.0 Discovery

[William Denniss <[e-mail]>]

It looks like discovery is useful for pure OAuth and OpenID Connect
providers alike.  What if we make *this* the primary document.  The OpenID
Connect metadata could be registered in the IANA registry here, and
potentially even revised to reference this doc.

There are benefits moving that work here, we would have an IANA registry
for metadata, and reach a broader audience.

As for the well-known path, given one was already established for similar
metadata and has already been rolled out by many, can we just grandfather
that and tolerate the name mismatch for the sake of avoiding duplication?

On Sat, Feb 6, 2016 at 3:14 AM, Torsten Lodderstedt <[e-mail]
> wrote:

> I think the service discovery document (describing all the endpoints and
> features of the AS) is a valid starting point. That's basically how we use
> the OIDC discovery in the OAuth context today at DT. We refer partners to
> the openid-configuration document. Putting the data relevant to OAuth under
> .well_known/oauth would be more reasonable from a OAuth developer's
> perspective (in my opinion).
>
> We still have to learn, how clients really discover the location of this
> discovery document. We can come up with extensions for user id/resource
> service data based discovery at any time, if we
>
> kind regards,
> Torsten.
>
>
> Am 05.02.2016 um 01:34 schrieb Justin Richer:
>
> +1, if we define a webfinger/rel at all.
>
> I would rather we just define the service discovery document, the thing that lives under .well-known.
>
>  — Justin
>
>
>
> On Feb 4, 2016, at 4:01 AM, Roland Hedberg <[e-mail]> <[e-mail]> wrote:
>
> +1
>
>
> 4 feb 2016 kl. 08:10 skrev Phil Hunt <[e-mail]> <[e-mail]>:
>
> +1 for adoption.
>
> However I would like a rel value distinct from OpenID (see separate email). While the mechanics of discovery is the same, I believe some clients will want to distinguish between OAuth AS’s and OIDC OPs.  Further, I would expect over time that different discovery features may be required. Locking them together seems like a pre-mature or rush choice.
>
> Phil
>
> @[e-mail]
>
>
>
>
>  On Feb 3, 2016, at 10:44 PM, William Denniss <[e-mail]> <[e-mail]> wrote:
>
> +1 for adoption of this document by the working group
>
> On Wed, Feb 3, 2016 at 10:27 PM, Mike Jones <[e-mail]> <[e-mail]> wrote:
> I support adoption of this document by the working group.  I'll note that elements of this specification are already in production use by multiple parties.
>
>                                -- Mike
>
> -----Original Message-----
> From: OAuth [mailto:[e-mail] <[e-mail]>] On Behalf Of Hannes Tschofenig
> Sent: Tuesday, January 19, 2016 3:49 AM
> To: [e-mail]
> Subject: [OAUTH-WG] Call for Adoption: OAuth 2.0 Discovery
>
> Hi all,
>
> this is the call for adoption of OAuth 2.0 Discovery, seehttps://tools.ietf.org/html/draft-jones-oauth-discovery-00
>
> Please let us know by Feb 2nd whether you accept / object to the adoption of this document as a starting point for work in the OAuth working group.
>
> Note: If you already stated your opinion at the IETF meeting in Yokohama then you don't need to re-state your opinion, if you want.
>
> The feedback at the Yokohama IETF meeting was the following: 19 for / zero against / 4 persons need more information.
>
> Ciao
> Hannes & Derek
>
> _______________________________________________
> OAuth mailing [e-mail]://www.ietf.org/mailman/listinfo/oauth
>
> _______________________________________________
> OAuth mailing [e-mail]://www.ietf.org/mailman/listinfo/oauth
>
> _______________________________________________
> OAuth mailing [e-mail]://www.ietf.org/mailman/listinfo/oauth
>
> _______________________________________________
> OAuth mailing [e-mail]://www.ietf.org/mailman/listinfo/oauth
>
>
>
> _______________________________________________
> OAuth mailing [e-mail]://www.ietf.org/mailman/listinfo/oauth
>
>
>
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth
>
>