IETF Logo Mail Archive

Re: [OAUTH-WG] 'Scope' parameter proposal

John Panzer <jpanzer@google.com> Tue, 27 April 2010 19:20 UTC

Return-Path: <jpanzer@google.com>
X-Original-To: oauth@core3.amsl.com
Delivered-To: oauth@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B757028C136 for <oauth@core3.amsl.com>; Tue, 27 Apr 2010 12:20:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.372
X-Spam-Level:
X-Spam-Status: No, score=-104.372 tagged_above=-999 required=5 tests=[AWL=0.115, BAYES_05=-1.11, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O+vdtJ0CgKew for <oauth@core3.amsl.com>; Tue, 27 Apr 2010 12:20:40 -0700 (PDT)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 473CE28C168 for <oauth@ietf.org>; Tue, 27 Apr 2010 12:20:28 -0700 (PDT)
Received: from wpaz21.hot.corp.google.com (wpaz21.hot.corp.google.com [172.24.198.85]) by smtp-out.google.com with ESMTP id o3RJKEXn020794 for <oauth@ietf.org>; Tue, 27 Apr 2010 12:20:15 -0700
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1272396015; bh=MLzneN0YkpFDBVgeyUTyg0hsEhY=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=nyyIUeEzyDVj+gwj9b8XvqsHAHXwkQe5tHZGs9eNyRFAN12PJYbQPXXLQT3forD5X lUT5wnBak5uZPMi3ytXlw==
DomainKey-Signature: a=rsa-sha1; s=beta; d=google.com; c=nofws; q=dns; h=mime-version:in-reply-to:references:from:date:message-id: subject:to:cc:content-type:x-system-of-record; b=K5lvlXFCe/BIiHcnodrzWgZBhWS4vlIhfJOPca80ZZ4O0GyLy5+c5TXHpheehdlWq czzP0s3YFRF7eBwVAvGoQ==
Received: from pwi9 (pwi9.prod.google.com [10.241.219.9]) by wpaz21.hot.corp.google.com with ESMTP id o3RJKCh3013198 for <oauth@ietf.org>; Tue, 27 Apr 2010 12:20:13 -0700
Received: by pwi9 with SMTP id 9so9878473pwi.41 for <oauth@ietf.org>; Tue, 27 Apr 2010 12:20:12 -0700 (PDT)
Received: by 10.141.131.15 with SMTP id i15mr219572rvn.18.1272396012473; Tue, 27 Apr 2010 12:20:12 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.141.100.15 with HTTP; Tue, 27 Apr 2010 12:19:52 -0700 (PDT)
In-Reply-To: <4BD731A0.8090105@lodderstedt.net>
References: <C7F1D1FC.32809%eran@hueniverse.com> <g2mdaf5b9571004221036j5d6837f6z4d7959d69a3cbb2b@mail.gmail.com> <BB02FD4F-071E-4FF5-B3D0-F8D3FA22FEEE@jkemp.net> <90C41DD21FB7C64BB94121FBBC2E723438E5C7FD26@P3PW5EX1MB01.EX1.SECURESERVER.NET> <h2ldaf5b9571004221235tb844eb6ah623955979526c1b6@mail.gmail.com> <90C41DD21FB7C64BB94121FBBC2E723438E5C7FD4A@P3PW5EX1MB01.EX1.SECURESERVER.NET> <l2idaf5b9571004221350oa0dbeb11ndeb4cb9147407ba9@mail.gmail.com> <255B9BB34FB7D647A506DC292726F6E1125793664B@WSMSG3153V.srv.dir.telstra.com> <w2sdaf5b9571004231705jbff1ae6dz70fd966f091502b3@mail.gmail.com> <4BD731A0.8090105@lodderstedt.net>
From: John Panzer <jpanzer@google.com>
Date: Tue, 27 Apr 2010 12:19:52 -0700
Message-ID: <i2qcb5f7a381004271219k6b58114dx1df549847f172edc@mail.gmail.com>
To: Torsten Lodderstedt <torsten@lodderstedt.net>
Content-Type: multipart/alternative; boundary="000325564916564d1c04853cc897"
X-System-Of-Record: true
Cc: OAuth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] 'Scope' parameter proposal
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 Apr 2010 19:20:42 -0000

The old AOL Blogs API, which used AOL's OpenAuth service, provided a url=
parameter on WWW-Authenticate: challenges:

dev.estage.aol.com/aolblogs_api#mozTocId815750

<http://webcache.googleusercontent.com/search?q=cache:VD8dYmqAaREJ:dev.estage.aol.com/aolblogs_api+AOL+OpenAuth+401+response+WWW-Authenticate&cd=9&hl=en&ct=clnk&gl=us>

   -  If authorization fails, a 401 response is returned with a
   WWW-Authenticate: header providing additional details.

WWW-Authenticate: OpenAuth realm="AOLBlogs", status="status", msg="message",
url="url"

This is from 2007 ;).

On Tue, Apr 27, 2010 at 11:49 AM, Torsten Lodderstedt <
torsten@lodderstedt.net> wrote:

> Am 24.04.2010 02:05, schrieb Brian Eaton:
>
>  On Thu, Apr 22, 2010 at 6:11 PM, Manger, James H
>> <James.H.Manger@team.telstra.com>  wrote:
>>
>>
>>> We mustn't drop advertisements (details in 401 responses).
>>> We mustn't drop the goal of a standard for interoperability.
>>>
>>>
>> I share the goals, I just don't think that a specification is the way
>> to get there.  I think working examples in the wild would help
>> enormously.
>>
>>
>>
>>> Defining a scope field in a 401 response is the novel aspect that “might
>>> not actually work”. Allowing a 'scope' query parameter in authz URIs is be
>>> quite separate.
>>>
>>>
>> Yeah, I agree with that analysis.
>>
>> Though I don't know of any providers that are returning authorization
>> URLs in 401 responses right now.  That's novel, too.
>>
>>
>>
>
> That's novel, yes. But I think no one did it before because there was no
> need to do so. BASIC and DIGEST don't require authorization endpoint
> coordinates. SPNEGO/Kerberos would be a candidate because of its
> architecture, but it uses the standard Kerberos mechanisms (config or
> DNS-based discovery via SRV records).
>
> I think there is a need for a standardized way of authorization server
> discovery. Using the WWW-Authentication header is better than nothing from
> my point of view.
>
> Alternatively, resource servers could publish their supported
> authentication servers via XRD or a similar mechanism. The authorization
> server in turn could publish its endpoints (and capabilities) the same way.
>
> regards,
> Torsten.
>
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>

v2.23.0 | Report a Bug | By Email