Re: [OAUTH-WG] Advertise PKCE support in OAuth 2.0 Discovery (draft-jones-oauth-discovery-00)

[William Denniss <[e-mail]>]

Thanks Mike, looking forward to the update. I reviewed the other thread.

On Mon, Jan 25, 2016 at 2:49 PM, Mike Jones <[e-mail]>
wrote:

> I'll add it to the discovery draft in the next day or so.  Also, please
> see my questions in the message "[OAUTH-WG] Discovery document updates
> planned". I was waiting for that feedback before doing the update.
>
> Thanks,
> -- Mike
> ------------------------------
> From: William Denniss <[e-mail]>
> Sent: ‎1/‎25/‎2016 2:29 PM
> To: John Bradley <[e-mail]>
> Cc: Nat Sakimura <[e-mail]>; [e-mail]; Mike Jones
> <[e-mail]>
> Subject: Re: [OAUTH-WG] Advertise PKCE support in OAuth 2.0 Discovery
> (draft-jones-oauth-discovery-00)
>
> OK great! It seems that we have consensus on this. So this is what we plan
> to add to our discovery doc, based on this discussion:
>
> "code_challenge_methods_supported": ["plain","S256"]
>
> What are the next steps? Can we we add it to
> https://tools.ietf.org/html/draft-jones-oauth-discovery directly? I see
> that the IANA registry created by that draft is "Specification Required",
> but PKCE is already an RFC without this param being registered.
>
>
> On Mon, Jan 25, 2016 at 2:11 PM, John Bradley <[e-mail]> wrote:
>
>> Yes sorry.   code_challenge_method is the query parameter so
>> code_challenge_methods_supported
>>
>>
>> On Jan 25, 2016, at 6:12 PM, William Denniss <[e-mail]> wrote:
>>
>>
>>
>> On Thu, Jan 21, 2016 at 6:17 AM, John Bradley <[e-mail]> wrote:
>>
>>> The code_challenge and code_challenge_method parameter names predate
>>> calling the spec PKCE.
>>>
>>> Given that some of us deployed early versions of PKCE in products and
>>> opensource to mitigate the problem before the spec was completed we decided
>>> not to rename the parameter names from code_verifier_method to
>>> pkce_verifier_method.
>>>
>>> For consistency we should stick with code_verifier_methods_supported in
>>> discovery.
>>>
>>
>> To clarify, did you mean "code_challenge_methods_supported"?  That is,
>> building on the param name "code_challenge_method" from Section 4.3
>> <https://tools.ietf.org/html/rfc7636#section-4.3>?
>>
>>
>>>
>>> John B.
>>>
>>> On Jan 21, 2016, at 3:12 AM, William Denniss <[e-mail]>
>>> wrote:
>>>
>>> "code_challenge_methods_supported" definitely works for me.
>>>
>>> Any objections to moving forward with that? I would like to update our
>>> discovery doc shortly.
>>>
>>> On Thu, Jan 21, 2016 at 1:37 PM, Nat Sakimura <[e-mail]>
>>> wrote:
>>>
>>>> Ah, OK. That's actually reasonable.
>>>>
>>>> 2016年1月21日(木) 9:31 nov matake <[e-mail]>:
>>>>
>>>>> I prefer “code_challenge_methods_supported”, since the registered
>>>>> parameter name is “code_challenge_method”, not “pkce_method".
>>>>>
>>>>> On Jan 19, 2016, at 11:58, William Denniss <[e-mail]>
>>>>> wrote:
>>>>>
>>>>> Seems like we agree this should be added. How should it look?
>>>>>
>>>>> Two ideas:
>>>>>
>>>>> "code_challenge_methods_supported": ["plain", "S256"]
>>>>>
>>>>> or
>>>>>
>>>>> "pkce_methods_supported": ["plain", "S256"]
>>>>>
>>>>>
>>>>>
>>>>> On Wed, Jan 6, 2016 at 9:59 AM, Torsten Lodderstedt <
>>>>> [e-mail]> wrote:
>>>>>
>>>>>> +1
>>>>>>
>>>>>>
>>>>>> Am 06.01.2016 um 18:25 schrieb William Denniss:
>>>>>>
>>>>>> +1
>>>>>>
>>>>>> On Wed, Jan 6, 2016 at 6:40 AM, John Bradley <[e-mail]>
>>>>>> wrote:
>>>>>>
>>>>>>> Good point.  Now that PKCE is a RFC we should add it to discovery.
>>>>>>>
>>>>>>> John B.
>>>>>>> > On Jan 6, 2016, at 9:29 AM, Vladimir Dzhuvinov <
>>>>>>> [e-mail]> wrote:
>>>>>>> >
>>>>>>> > I just noticed PKCE support is missing from the discovery metadata.
>>>>>>> >
>>>>>>> > Is it a good idea to add it?
>>>>>>> >
>>>>>>> > Cheers,
>>>>>>> >
>>>>>>> > Vladimir
>>>>>>> >
>>>>>>> > --
>>>>>>> > Vladimir Dzhuvinov
>>>>>>> >
>>>>>>> >
>>>>>>> > _______________________________________________
>>>>>>> > OAuth mailing list
>>>>>>> > [e-mail]
>>>>>>> > https://www.ietf.org/mailman/listinfo/oauth
>>>>>>>
>>>>>>> _______________________________________________
>>>>>>> OAuth mailing list
>>>>>>> [e-mail]
>>>>>>> https://www.ietf.org/mailman/listinfo/oauth
>>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> _______________________________________________
>>>>>> OAuth mailing [e-mail]://www.ietf.org/mailman/listinfo/oauth
>>>>>>
>>>>>>
>>>>>>
>>>>> _______________________________________________
>>>>> OAuth mailing list
>>>>> [e-mail]
>>>>> https://www.ietf.org/mailman/listinfo/oauth
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> OAuth mailing list
>>>>> [e-mail]
>>>>> https://www.ietf.org/mailman/listinfo/oauth
>>>>>
>>>>
>>> _______________________________________________
>>> OAuth mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/oauth
>>>
>>>
>>>
>>
>>
>