[OAUTH-WG] Device Profile

[Aiden Bell <[e-mail]>]

Hi,

I am currently implementing the device profile described at
http://tools.ietf.org/html/draft-recordon-oauth-v2-device-00

Wanted to check this hadn't been superseded by any other document or
protocol
though I did notice the Google implementation is in-line with this document.

Even though the summary states this is intended for limited input devices in
combination with a full user agent (PC browser, smartphone browser),

We are finding this extension useful for app authentication when the API
serving the app is "open". This means that many developers can create
mobile apps for one API, in conjunction with single users. For example,
many apps may exist for the same API, and a single user may use many
apps.

As a result, we want to remove the requirement for ever entering use
account-specific
data (passwords etc) into apps, and allow a user to revoke app/device access
on a per-instance
basis. The end-user concerns of password security are lessened here.

With OpenID or WebID in the mix, this further enhances the app/device
authentication
process as in an OpenID/WebID or similar setting, we can't always do
resource owner password
credentals (as in 1.4.3 of OAuth 2.0
http://tools.ietf.org/html/draft-ietf-oauth-v2-20 )

Unless I am missing another document or flow that provides the above better,
(most likely I am)
perhaps it is worth extending the scope/summary of device-00?

Also, typo in the JSON

  HTTP/1.1 200 OK
  Content-Type: application/json
  Cache-Control: no-store

  {
    "device_code":"74tq5miHKB",
    "user_code":"94248",
    "verification_uri":"http://www.example.com/device",
     "interval"=5
   }

I think should be:

  HTTP/1.1 200 OK
  Content-Type: application/json
  Cache-Control: no-store

  {
     "device_code":"74tq5miHKB",
     "user_code":"94248",
     "verification_uri":"http://www.example.com/device",
     "interval":5
  }

Thanks,
Aiden

-- 
------------------------------------------------------------------
Never send sensitive or private information via email unless it is
encrypted. http://www.gnupg.org