Re: [OAUTH-WG] OAuth 2.0 Discovery Location
Samuel Erdtman <samuel@erdtman.se> Mon, 22 February 2016 06:20 UTC
Return-Path: <samuel@erdtman.se>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 623C21B357C for <oauth@ietfa.amsl.com>; Sun, 21 Feb 2016 22:20:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.277
X-Spam-Level:
X-Spam-Status: No, score=-1.277 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dIiYnmavbphn for <oauth@ietfa.amsl.com>; Sun, 21 Feb 2016 22:20:41 -0800 (PST)
Received: from mail-qg0-x231.google.com (mail-qg0-x231.google.com [IPv6:2607:f8b0:400d:c04::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 737D91B357B for <oauth@ietf.org>; Sun, 21 Feb 2016 22:20:41 -0800 (PST)
Received: by mail-qg0-x231.google.com with SMTP id y89so104530613qge.2 for <oauth@ietf.org>; Sun, 21 Feb 2016 22:20:41 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=erdtman-se.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=Ifm86cs7b7oUoRgtCGGeh9wdDHEqAYg4o77l2COymfY=; b=K5zoYv/Brm+WZJ3uKTWkGgwP9RK8QL338FFSsBiQB6mkn/sdn1u87dHYXc9CRFzIT6 D1YkfVYlVXrNf+J+mPNSaji76aGQZ4/DaFAWYvcWlbJBTV26ugGNK4woqKCD2GKaZbps JZcjWqKNbUehfYveJyFrmt1BAMsrdx+yi+45eypMS0lM+nG2/peGOt9zmJNuMwONuBxJ ixkOJ7lF5BJKWIiEKyyQEMaFMRacrzmO1+A/dNMzOyXGgw9QMKIRrUsVUwOOyQpaN0lj 3GcB/1l1xy2L1pzCD5SPOUFgIrD6oD0reBrYqO1KBgbxMTdibEkVctlLpkM89a3Eq25U y4ZA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=Ifm86cs7b7oUoRgtCGGeh9wdDHEqAYg4o77l2COymfY=; b=a4LliJnZyTyW92ac1rCnIYoZAbK4K6AR94f+2oEUlyiJDZPc+BzghG1+YWlL+RbLK+ VXA5Uxp0mchsIW4yUcuU3dPLrT9FMt7sOgH3ff4IryYYwOqW18PcaeE05FvG8V+RR8o5 ehIoJGbM54jegHMfAbjbbremuMj5YvIC0qqYtprnAj/TgZaxhXNv/ZpHRReeFPdCnD/Q +48XikEsCd6btzkZJBnSVQL5eQioAy3Hbjl+jXsgtPAtajU8ldVuXEM1kdzmh8D2ydxk uQ9CDvU+E0lqLemKhvzbDPcPZSi96S3plKdfQeSIj3VY1hQuvv1pqxG+0lQIJO3ATZVb ylCg==
X-Gm-Message-State: AG10YOTLQ4PtBnMRiVhmiNm9pIWYoikR/yxbf0HWMSyELTqHljM4J8aa7Y/tWiZlovT/EPqTZ7jqY2MZ/7JHBw==
MIME-Version: 1.0
X-Received: by 10.140.147.4 with SMTP id 4mr34546347qht.93.1456122040540; Sun, 21 Feb 2016 22:20:40 -0800 (PST)
Received: by 10.55.179.1 with HTTP; Sun, 21 Feb 2016 22:20:40 -0800 (PST)
In-Reply-To: <E3BDAD5F-6DE2-4FB9-AEC0-4EE2D2BF8AC8@mit.edu>
References: <E3BDAD5F-6DE2-4FB9-AEC0-4EE2D2BF8AC8@mit.edu>
Date: Mon, 22 Feb 2016 07:20:40 +0100
Message-ID: <CAF2hCbZ=kBUsz5+W33tw-MQ+YUBC9Hrjbv8kCY45F09+tN_68Q@mail.gmail.com>
From: Samuel Erdtman <samuel@erdtman.se>
To: Justin Richer <jricher@mit.edu>
Content-Type: multipart/alternative; boundary="001a11445230fa1460052c55d4e0"
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/w4al993vYkSAzIN4CNCLo1CDO8s>
Cc: "<oauth@ietf.org>" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] OAuth 2.0 Discovery Location
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 22 Feb 2016 06:20:43 -0000
Hi, I agree that the user of “/.well-known/openid-configuration” is confusing and that it would be preferable with something else, but it is written as an example not necessarily a default. However to use “/.well-known/oauth-authorization-server” might be problematic if as written different applications needs different content in the discovery endpoint. (3. Obtaining Authorization Server Discovery Metadata) //Samuel On Fri, Feb 19, 2016 at 10:59 PM, Justin Richer <jricher@mit.edu> wrote: > The newly-trimmed OAuth Discovery document is helpful and moving in the > right direction. It does, however, still have too many vestiges of its > OpenID Connect origins. One issue in particular still really bothers me: > the use of “/.well-known/openid-configuration” in the discovery portion. Is > this an OAuth discovery document, or an OpenID Connect one? There is > absolutely no compelling reason to tie the URL to the OIDC discovery > mechanism. > > I propose that we use “/.well-known/oauth-authorization-server” as the > default discovery location, and state that the document MAY also be > reachable from “/.well-known/openid-configuration” if the server also > provides OpenID Connect on the same domain. Other applications SHOULD use > the same parameter names to describe OAuth endpoints and functions inside > their service-specific discovery document. > > — Justin > _______________________________________________ > OAuth mailing list > OAuth@ietf.org > https://www.ietf.org/mailman/listinfo/oauth >
- [OAUTH-WG] OAuth 2.0 Discovery Location Justin Richer
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Vladimir Dzhuvinov
- [OAUTH-WG] OAuth 2.0 Discovery Location Samuel Erdtman
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Samuel Erdtman
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Thomas Broyer
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Justin Richer
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Nat Sakimura
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Phil Hunt
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Thomas Broyer
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Nat Sakimura
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Nat Sakimura
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Phil Hunt (IDM)
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Mike Jones
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Anthony Nadalin
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Mike Jones
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Anthony Nadalin
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Mike Jones
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location George Fletcher
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Phil Hunt (IDM)
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Mike Jones
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Phil Hunt (IDM)
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Mike Jones
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Phil Hunt (IDM)
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Mike Jones
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Phil Hunt (IDM)
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Mike Jones
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Phil Hunt (IDM)
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Manger, James
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Vladimir Dzhuvinov
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Vladimir Dzhuvinov
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Donald F. Coffin
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location George Fletcher
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Nat Sakimura
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location George Fletcher
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location George Fletcher
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Vladimir Dzhuvinov
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Donald F. Coffin
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Thomas Broyer
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Mike Jones
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location George Fletcher
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Donald F. Coffin
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location John Bradley
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Manger, James
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Nat Sakimura
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location nov matake
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location John Bradley
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location George Fletcher
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Justin Richer
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location torsten@lodderstedt.net
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Samuel Erdtman
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Mike Jones
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Phil Hunt
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Vladimir Dzhuvinov
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Mike Jones
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Phil Hunt
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Mike Jones
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Brian Campbell
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Brian Campbell
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Roland Hedberg
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Vladimir Dzhuvinov
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location Thomas Broyer
- Re: [OAUTH-WG] OAuth 2.0 Discovery Location George Fletcher