To: Thomas Broyer <t.broyer@gmail.com>,
 Sergey Beryozkin <sberyozkin@gmail.com>, Justin Richer <jricher@mit.edu>
References: <78kleo9cmvytysxs1qv8kep0.1453117674832@email.android.com>
 <569CDE25.90908@gmail.com>
 <CAAP42hA_3EmJw7fAXSSfg=KynAMF26x6vgm1HyLX1RAS4OpKfQ@mail.gmail.com>
 <569E08F6.4040600@gmail.com> <56A7B52C.2040302@gmail.com>
 <CAEayHEMrTjDQbdoX3C-2-oGUVVQTzCzDqbWU-hFeAtbSp-tCcg@mail.gmail.com>
 <7E08DFCA-ADBC-481A-896A-2725E1F79EFA@mit.edu> <56A8A762.9080004@gmail.com>
 <CAEayHEPi7hsu=zkr_qxadp02D9zzLGVDU-AGVZXzm25vE2bJFw@mail.gmail.com>
 <56A8B542.5060208@gmail.com> <56A8BE1B.2080404@aol.com>
 <CAEayHEOtpUxMRKduitbe=D3UFHSazMmkf9UQoiPNjZFr0JATOA@mail.gmail.com>
From: George Fletcher <gffletch@aol.com>
Organization: AOL LLC
Message-ID: <56A8F3A5.8060002@aol.com>
Date: Wed, 27 Jan 2016 11:43:17 -0500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0)
 Gecko/20100101 Thunderbird/38.5.1
MIME-Version: 1.0
In-Reply-To: <CAEayHEOtpUxMRKduitbe=D3UFHSazMmkf9UQoiPNjZFr0JATOA@mail.gmail.com>
Content-Type: multipart/alternative;
 boundary="------------040607060106050503050807"
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/sJekQ-1DP3buj5h3uAeaxGzV63E>
Cc: "<oauth@ietf.org>" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Can the repeated authorization of scopes be avoided ?
Precedence: list

This is a multi-part message in MIME format.
--------------040607060106050503050807
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit

Yes, I was thinking mostly of "native apps"... though you bring up a 
good point. It would be great if "installable" web apps could do dynamic 
client registration:)  I suppose for a "public" client that is loaded 
onto a device, the "installation" process could obtain a new client_id 
for that instance. Cookies might work, or have the app generate a unique 
identifier and use that in conjunction with the client_id?

Thanks,
George

On 1/27/16 11:07 AM, Thomas Broyer wrote:
>
>
> On Wed, Jan 27, 2016 at 1:54 PM George Fletcher <gffletch@aol.com 
> <mailto:gffletch@aol.com>> wrote:
>
>     The difference might be whether you want to store the scope
>     consent by client "instance" vs client_id application "class".
>
>
> Correct me if I'm wrong but this only makes sense for "native apps", 
> not for web apps, right?
> (of course, now with "installable web apps" –e.g. progressive web 
> apps–, lines get blurry; any suggestion how you'd do it then? cookies?)

-- 
Chief Architect
Identity Services Engineering     Work: george.fletcher@teamaol.com
AOL Inc.                          AIM:  gffletch
Mobile: +1-703-462-3494           Twitter: http://twitter.com/gffletch
Office: +1-703-265-2544           Photos: http://georgefletcher.photography


--------------040607060106050503050807
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit

<html>
  <head>
    <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <font face="Helvetica, Arial, sans-serif">Yes, I was thinking mostly
      of "native apps"... though you bring up a good point. It would be
      great if "installable" web apps could do dynamic client
      registration:)  I suppose for a "public" client that is loaded
      onto a device, the "installation" process could obtain a new
      client_id for that instance. Cookies might work, or have the app
      generate a unique identifier and use that in conjunction with the
      client_id?<br>
      <br>
      Thanks,<br>
      George<br>
    </font><br>
    <div class="moz-cite-prefix">On 1/27/16 11:07 AM, Thomas Broyer
      wrote:<br>
    </div>
    <blockquote
cite="mid:CAEayHEOtpUxMRKduitbe=D3UFHSazMmkf9UQoiPNjZFr0JATOA@mail.gmail.com"
      type="cite">
      <div dir="ltr"><br>
        <br>
        <div class="gmail_quote">
          <div dir="ltr">On Wed, Jan 27, 2016 at 1:54 PM George Fletcher
            &lt;<a moz-do-not-send="true" href="mailto:gffletch@aol.com">gffletch@aol.com</a>&gt;
            wrote:<br>
          </div>
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000"> <font
                face="Helvetica, Arial, sans-serif">The difference might
                be whether you want to store the scope consent by client
                "instance" vs client_id application "class".</font></div>
          </blockquote>
          <div><br>
          </div>
          <div>Correct me if I'm wrong but this only makes sense for
            "native apps", not for web apps, right?</div>
          <div>(of course, now with "installable web apps" –e.g.
            progressive web apps–, lines get blurry; any suggestion how
            you'd do it then? cookies?)</div>
        </div>
      </div>
    </blockquote>
    <br>
    <pre class="moz-signature" cols="72">-- 
Chief Architect                   
Identity Services Engineering     Work: <a class="moz-txt-link-abbreviated" href="mailto:george.fletcher@teamaol.com">george.fletcher@teamaol.com</a>
AOL Inc.                          AIM:  gffletch
Mobile: +1-703-462-3494           Twitter: <a class="moz-txt-link-freetext" href="http://twitter.com/gffletch">http://twitter.com/gffletch</a>
Office: +1-703-265-2544           Photos: <a class="moz-txt-link-freetext" href="http://georgefletcher.photography">http://georgefletcher.photography</a>
</pre>
  </body>
</html>

--------------040607060106050503050807--