Re: [Txauth] Decoupling consent and authorization

Hi Fabien

If I understand this correctly, you are factoring out the user
authentication and consent from the AS issuing the access token. Correct?

wrt. "the interaction handled by a Client endpoint" .. I think there is a
conflation of the term Client ... software that can authenticate the user
and act in the user's interest is NOT the GNAP Client. Perhaps Agent? ...
it is a different component from the Client.

On Mon, Aug 3, 2020 at 4:15 AM Fabien Imbault <fabien.imbault@gmail.com>
wrote:

> Hello,
>
> This is a new thread.
>
> I have just published a proof of concept that separates the interaction
> from the rest of the AS. The goal is to open up the door to a privacy
> preserving flow such as the one suggested by Denis (the interaction may be
> handled by a Client endpoint, if it wishes), as well as to optimize the
> implementation to each concern (UX for consent vs authorization flows).
>
> Note that it ends up being an implementation detail as far as the Client
> is concerned, as the core request/response format wasn't changed from the
> original XYZ protocol.
>
> The code and documentation is available publicly at:
> https://github.com/acertio/mvp_gnap_interact
>
> The flow is sketched and explained at
> https://github.com/acertio/mvp_gnap_interact/blob/master/Redirect.md#process
>
> Let me know what you think.
>
> Cheers
>
> Fabien
>
> --
> Txauth mailing list
> Txauth@ietf.org
> https://www.ietf.org/mailman/listinfo/txauth
>