Re: [OAUTH-WG] OAuth 2.0 Discovery Location

Samuel Erdtman <samuel@erdtman.se> Mon, 22 February 2016 06:20 UTC

Return-Path: <samuel@erdtman.se>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 623C21B357C for <oauth@ietfa.amsl.com>; Sun, 21 Feb 2016 22:20:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.277
X-Spam-Level:
X-Spam-Status: No, score=-1.277 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dIiYnmavbphn for <oauth@ietfa.amsl.com>; Sun, 21 Feb 2016 22:20:41 -0800 (PST)
Received: from mail-qg0-x231.google.com (mail-qg0-x231.google.com [IPv6:2607:f8b0:400d:c04::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 737D91B357B for <oauth@ietf.org>; Sun, 21 Feb 2016 22:20:41 -0800 (PST)
Received: by mail-qg0-x231.google.com with SMTP id y89so104530613qge.2 for <oauth@ietf.org>; Sun, 21 Feb 2016 22:20:41 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=erdtman-se.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=Ifm86cs7b7oUoRgtCGGeh9wdDHEqAYg4o77l2COymfY=; b=K5zoYv/Brm+WZJ3uKTWkGgwP9RK8QL338FFSsBiQB6mkn/sdn1u87dHYXc9CRFzIT6 D1YkfVYlVXrNf+J+mPNSaji76aGQZ4/DaFAWYvcWlbJBTV26ugGNK4woqKCD2GKaZbps JZcjWqKNbUehfYveJyFrmt1BAMsrdx+yi+45eypMS0lM+nG2/peGOt9zmJNuMwONuBxJ ixkOJ7lF5BJKWIiEKyyQEMaFMRacrzmO1+A/dNMzOyXGgw9QMKIRrUsVUwOOyQpaN0lj 3GcB/1l1xy2L1pzCD5SPOUFgIrD6oD0reBrYqO1KBgbxMTdibEkVctlLpkM89a3Eq25U y4ZA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=Ifm86cs7b7oUoRgtCGGeh9wdDHEqAYg4o77l2COymfY=; b=a4LliJnZyTyW92ac1rCnIYoZAbK4K6AR94f+2oEUlyiJDZPc+BzghG1+YWlL+RbLK+ VXA5Uxp0mchsIW4yUcuU3dPLrT9FMt7sOgH3ff4IryYYwOqW18PcaeE05FvG8V+RR8o5 ehIoJGbM54jegHMfAbjbbremuMj5YvIC0qqYtprnAj/TgZaxhXNv/ZpHRReeFPdCnD/Q +48XikEsCd6btzkZJBnSVQL5eQioAy3Hbjl+jXsgtPAtajU8ldVuXEM1kdzmh8D2ydxk uQ9CDvU+E0lqLemKhvzbDPcPZSi96S3plKdfQeSIj3VY1hQuvv1pqxG+0lQIJO3ATZVb ylCg==
X-Gm-Message-State: AG10YOTLQ4PtBnMRiVhmiNm9pIWYoikR/yxbf0HWMSyELTqHljM4J8aa7Y/tWiZlovT/EPqTZ7jqY2MZ/7JHBw==
MIME-Version: 1.0
X-Received: by 10.140.147.4 with SMTP id 4mr34546347qht.93.1456122040540; Sun, 21 Feb 2016 22:20:40 -0800 (PST)
Received: by 10.55.179.1 with HTTP; Sun, 21 Feb 2016 22:20:40 -0800 (PST)
In-Reply-To: <E3BDAD5F-6DE2-4FB9-AEC0-4EE2D2BF8AC8@mit.edu>
References: <E3BDAD5F-6DE2-4FB9-AEC0-4EE2D2BF8AC8@mit.edu>
Date: Mon, 22 Feb 2016 07:20:40 +0100
Message-ID: <CAF2hCbZ=kBUsz5+W33tw-MQ+YUBC9Hrjbv8kCY45F09+tN_68Q@mail.gmail.com>
From: Samuel Erdtman <samuel@erdtman.se>
To: Justin Richer <jricher@mit.edu>
Content-Type: multipart/alternative; boundary=001a11445230fa1460052c55d4e0
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/w4al993vYkSAzIN4CNCLo1CDO8s>
Cc: "<oauth@ietf.org>" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] OAuth 2.0 Discovery Location
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 22 Feb 2016 06:20:43 -0000

Hi,

I agree that the user of “/.well-known/openid-configuration” is confusing and
that it would be preferable with something else, but it is written as an
example not necessarily a default.

However to use “/.well-known/oauth-authorization-server” might be
problematic if as written different applications needs different content in
the discovery endpoint. (3.  Obtaining Authorization Server Discovery
Metadata)

//Samuel

On Fri, Feb 19, 2016 at 10:59 PM, Justin Richer <jricher@mit.edu> wrote:

> The newly-trimmed OAuth Discovery document is helpful and moving in the
> right direction. It does, however, still have too many vestiges of its
> OpenID Connect origins. One issue in particular still really bothers me:
> the use of “/.well-known/openid-configuration” in the discovery portion. Is
> this an OAuth discovery document, or an OpenID Connect one? There is
> absolutely no compelling reason to tie the URL to the OIDC discovery
> mechanism.
>
> I propose that we use “/.well-known/oauth-authorization-server” as the
> default discovery location, and state that the document MAY also be
> reachable from “/.well-known/openid-configuration” if the server also
> provides OpenID Connect on the same domain. Other applications SHOULD use
> the same parameter names to describe OAuth endpoints and functions inside
> their service-specific discovery document.
>
>  — Justin
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>