Re: [OAUTH-WG] Suggested enhancement of the OAuth Device Flow

[Jaap Francke <[e-mail]>]

Hi Justin,

Thanks for your reply.

I had missed your proposal, but it’s indeed the same line-of-thought.
My proposal is slightly different in the sense that the device_name (or: instance_name) would not originate from the client itself but from the ResourceOwner, e.g. during the authorisation process.
This is probably specific or at least more relevant to devices with input constraints.

I understand the point about dynamic client registration. 
At a first glance it seems very ‘open’, whereas in a lot of case you wouldn’t want any client to register. 
Moreover, I feel that using dynamic client registration just for the sake of setting up identifiers for a client instance seems a bit ‘heavy’.
So I still feel it’s usefull to enhance the Device flow with something like: device_identifier / device_name / instance_name / instance_description

regards, Jaap


> Message: 2
> Date: Fri, 7 Jul 2017 07:54:13 -0400
> From: Justin Richer <[e-mail]>
> To: [e-mail]
> Subject: Re: [OAUTH-WG] Suggested enhancement of the OAuth Device Flow
> Message-ID: <[e-mail]>
> Content-Type: text/plain; charset=utf-8; format=flowed
> 
> I proposed this exact thing many years ago:
> 
> https://tools.ietf.org/html/draft-richer-oauth-instance-00
> 
> At the time there wasn't very much interest in it, as people were 
> looking at using Dynamic Registration, with its attendant unique client 
> IDs, to solve that same problem.
> 
>  -- Justin