IETF Logo Mail Archive

Re: [OAUTH-WG] Can i use domain name for oauth2 client id?

Justin Richer <jricher@mit.edu> Mon, 29 August 2016 15:56 UTC

Return-Path: <jricher@mit.edu>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8529E12D125 for <oauth@ietfa.amsl.com>; Mon, 29 Aug 2016 08:56:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.748
X-Spam-Level:
X-Spam-Status: No, score=-4.748 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zvLnzbxZ-zhj for <oauth@ietfa.amsl.com>; Mon, 29 Aug 2016 08:56:57 -0700 (PDT)
Received: from dmz-mailsec-scanner-2.mit.edu (dmz-mailsec-scanner-2.mit.edu [18.9.25.13]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 08A4312D10B for <oauth@ietf.org>; Mon, 29 Aug 2016 08:56:56 -0700 (PDT)
X-AuditID: 1209190d-f27ff70000000d6f-63-57c45b478865
Received: from mailhub-auth-4.mit.edu ( [18.7.62.39]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id B9.3C.03439.74B54C75; Mon, 29 Aug 2016 11:56:55 -0400 (EDT)
Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-4.mit.edu (8.13.8/8.9.2) with ESMTP id u7TFutLN030663; Mon, 29 Aug 2016 11:56:55 -0400
Received: from [10.93.2.174] ([62.237.32.178]) (authenticated bits=0) (User authenticated as jricher@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id u7TFupM4011730 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 29 Aug 2016 11:56:54 -0400
Content-Type: multipart/alternative; boundary="Apple-Mail=_76546578-EBB3-46C2-B5B4-53ABC26A9B2D"
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
From: Justin Richer <jricher@mit.edu>
In-Reply-To: <CALL5ZAsgxZo30bbzk18aHDOaZiLVp27ZEWPtf+LrOgzwdbvEVw@mail.gmail.com>
Date: Mon, 29 Aug 2016 18:56:51 +0300
Message-Id: <50F0DFCB-31D3-47F8-BC0E-3D52383ACECA@mit.edu>
References: <CALL5ZAsgxZo30bbzk18aHDOaZiLVp27ZEWPtf+LrOgzwdbvEVw@mail.gmail.com>
To: Viruthagiri Thirumavalavan <giridharanbtech@gmail.com>
X-Mailer: Apple Mail (2.3124)
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmphleLIzCtJLcpLzFFi42IRYrdT13WPPhJucPGIlUXbhXssFiffvmJz YPLYOesuu8eSJT+ZApiiuGxSUnMyy1KL9O0SuDL2PbzIWPBbruLPtG7mBsanUl2MnBwSAiYS L9+/YOti5OIQEmhjkvgwfSMrhLORUWLhhiNQzmomiRdn1rKDtDALJEhsvbOUGcTmFdCT2LT+ LROILSzgLLHg8U1GEJtNQFVi+poWsDinQKDEsWVPwWwWoPj69g9AcziA5qhLtJ90gRhjJTFl 4QKw8UICARKHXjWDjRcBiq99fpoZ4lJZiScnF7FMYOSfheSKWUiugIhrSyxb+JoZwtaU2N+9 nAVTXEOi89tE1gWMbKsYZVNyq3RzEzNzilOTdYuTE/PyUot0jfRyM0v0UlNKNzGCAptTkncH 47+7XocYBTgYlXh4LZyOhAuxJpYVV+YeYpTkYFIS5S25czhciC8pP6UyI7E4I76oNCe1+BCj BAezkgjvCn+gct6UxMqq1KJ8mJQ0B4uSOG/XjAPhQgLpiSWp2ampBalFMFkZDg4lCd5rkUCN gkWp6akVaZk5JQhpJg5OkOE8QMM3gdTwFhck5hZnpkPkTzEqSonzXosASgiAJDJK8+B6QYnH 7q3CpleM4kCvCPPyRAFV8QCTFlz3K6DBTECDC0A+4i0uSURISTUwqkU5lFovyN7i7ZM4I7mA y2KvvhZvzoniOP6JqtvEty6v3HOQ07Haho/33ML7RaaHTtn9/ehzZfeyyl87uMJqt9bKL2o6 m/jZLXPRIV25+tg5oT9U99fOD6w32qD33zb9Ml+IZ7eotYbmCnfd5JfH7DaWlk5adn/OBCsl v7kXNxadmnamtiheiaU4I9FQi7moOBEAgq1xMxcDAAA=
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/uP3SEw1t5zFFCS92lX5lNxI8HtM>
Cc: "<oauth@ietf.org>" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Can i use domain name for oauth2 client id?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 29 Aug 2016 15:56:58 -0000

Dots are legal in a client ID (as per the spec), and there’s nothing inherently wrong with a client ID that’s a domain name. However, how can you be sure it’s google that gets the client ID “google.com <http://google.com/>”? And what if Google wants to have two clients?

In many implementations (including ours from MIT ITC), the client ID is random (we use a type 4 UUID) and we’ve got a separate field for human-readable names (client_name, defined in the dynamic registration specification).

 — Justin

> On Aug 29, 2016, at 12:51 AM, Viruthagiri Thirumavalavan <giridharanbtech@gmail.com> wrote:
> 
> I'm working on a OAuth2 server project. Can I use domain name for generating client_id ?
> 
> Ex: For instance if Google registering an app in my server, then the client_id will be google.com <http://google.com/>
> Am i allowed to use dots in client_id? Is it wise to use domain name as client_id ? what are the drawbacks?
> 
> Thanks
> -- 
> Regards,
> Giri
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth

v2.23.0 | Report a Bug | By Email