Re: [OAUTH-WG] 'Scope' parameter proposal

On Apr 22, 2010, at 2:21 PM, Brian Eaton wrote:

> On Thu, Apr 22, 2010 at 11:01 AM, Eran Hammer-Lahav <eran@hueniverse.com> wrote:
>> Rules around realms show this is very tricky but unless we update 2617 (which we
>> are not chartered to do) we are still stuck with realm as a required parameter.
>> One way to avoid this debate is to simply say that clients should use realms to
>> decide when to reuse tokens. It doesn't solve the problem, but it doesn't create a
>> new one either.
> 
> The existing rules for realm are basically same-origin policy.

Well, that's usually true in practice for HTTP BASIC, but looking at RFC2617, realm is really about telling the *user* the necessary credentials to access that resource. So 'realm' is supposed to be user-informative text, and could thus easily be something other than same-origin policy based. In fact the word 'realm' makes 'security realm' spring to mind. I don't think that by definition it excludes "multiple origins". 

>  That
> doesn't actually work for any of the delegated auth solutions that
> OAuth2 is based on, and is meant to replace.  Telling people to use
> realm is terrible, no-good, very-bad advice.

Realm is intended to be information to guide a user on what credentials to use. OAuth is not concerned as such with credentials, it's concerned with authorization tokens. So I agree, we shouldn't use realm for something other than informing the user, should that be necessary. 

> 
> As far as I can tell, the only practical guidance we can give
> developers is "follow the service provider documentation."

Agree.

- johnk

> 
> Cheers,
> Brian
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth