Subject: [OAUTH-WG] draft 9, section 4.3.1 missing error code for invalid user credentials

From: Andrew Arnott <[email-masked]>
Date: Sat, 3 Jul 2010 17:28:24 -0700

I see an invalid-client-credentials error code, but for the
basic-credentials grant type, it seems there should be a specific error code
to indicate the resource owner's basic creds are invalid, as opposed to the
client's credentials being invalid.

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death
your right to say it." - S. G. Tallentyre

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Sat, 3 Jul 2010 21:50:17 -0700

There is no difference. The client credentials are either valid or not.

EHL

On 7/3/10 5:28 PM, "Andrew Arnott" <[email-masked]> wrote:

I see an invalid-client-credentials error code, but for the basic-credentials grant type, it seems there should be a specific error code to indicate the resource owner's basic creds are invalid, as opposed to the client's credentials being invalid.

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre

---

From: Andrew Arnott <[email-masked]>
Date: Sun, 4 Jul 2010 19:33:19 -0700

Well, to the client app there's an important distinction I think.  If the
client id and secret are invalid, that signifies either an internal error or
a total revocation of support for the client.  But the username/password
being bad means the client should ask the user to re-enter their
credentials.  Otherwise it leads to user frustration that the client keeps
putting up a reprompt for creds when it will never end up working.

So from a client perspective it seems like an important distinction.  no?
--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death
your right to say it." - S. G. Tallentyre

On Sat, Jul 3, 2010 at 9:50 PM, Eran Hammer-Lahav <[email-masked]>wrote:

> I see an invalid-client-credentials error code, but for
> the basic-credentials grant type, it seems there should be a specific error
> code to indicate the resource owner's basic creds are invalid, as opposed to
> the client's credentials being invalid.
>
> --
> Andrew Arnott

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Sun, 4 Jul 2010 19:48:39 -0700

If the client credentials are bad the server returns: invalid-client-credentials
If the end-user's credentials are bad, the server returns: invalid-grant

Not sure what's the issue.

EHL

On 7/4/10 7:33 PM, "Andrew Arnott" <[email-masked]> wrote:

Well, to the client app there's an important distinction I think.  If the client id and secret are invalid, that signifies either an internal error or a total revocation of support for the client.  But the username/password being bad means the client should ask the user to re-enter their credentials.  Otherwise it leads to user frustration that the client keeps putting up a reprompt for creds when it will never end up working.

On Sat, Jul 3, 2010 at 9:50 PM, Eran Hammer-Lahav <[email-masked]> wrote:
There is no difference. The client credentials are either valid or not.

EHL

On 7/3/10 5:28 PM, "Andrew Arnott" <[email-masked] <http://[email-masked]> > wrote:

---

From: Andrew Arnott <[email-masked]>
Date: Mon, 5 Jul 2010 07:00:37 -0700

No issue. I didn't consider invalid-grant, but reading it more carefully I
should have. Yes, the distinction I was looking for is there.

Thanks.

On Sun, Jul 4, 2010 at 7:48 PM, Eran Hammer-Lahav <[email-masked]>wrote:

> If the end-user’s credentials are bad, the server returns: invalid-grant
>
> Not sure what’s the issue.
>
> EHL
>
>
>