Subject: [OAUTH-WG] In dire need of the device flow

From: "Arnout J. Kuiper" <[email-masked]>
Date: Thu, 08 Jul 2010 22:22:48 +0200

Hi,

Long story short, a while ago we (the company I work for) created our 
own protocols, which after investigation, matched the device flow in the 
earlier versions of the OAuth2 spec exactly. I'm in favor of open 
standards, so I would like to conform to the OAuth2 specification, if 
possible.

Up to version 6 of the spec, I was very happy, because the device flow 
perfectly matched our specific needs (having to deal with embedded 
software communicating with our API, with no browser (or no trusted 
browser) available in some devices). Now the device flow is gone.

Can somebody tell me what the current position is on the device flow, 
and whether there is a place for it in the OAuth2 specification?

Cheers,

   --Arnout Kuiper

---

From: Marius Scurtescu <[email-masked]>
Date: Thu, 8 Jul 2010 13:28:54 -0700

I think the idea was to create a separate spec for the device flow, so
that the core spec can be finished faster.

The device flow described in version 6 can be the starting point for
this separate spec, and if you are saying that something like this is
already implemented, then it could be quite close to a stable version.

Marius

On Thu, Jul 8, 2010 at 1:22 PM, Arnout J. Kuiper <[email-masked]> wrote:
> Hi,
>
> Long story short, a while ago we (the company I work for) created our own
> protocols, which after investigation, matched the device flow in the earlier
> versions of the OAuth2 spec exactly. I'm in favor of open standards, so I
> would like to conform to the OAuth2 specification, if possible.
>
> perfectly matched our specific needs (having to deal with embedded software
> communicating with our API, with no browser (or no trusted browser)
> available in some devices). Now the device flow is gone.
>
> Can somebody tell me what the current position is on the device flow, and
> whether there is a place for it in the OAuth2 specification?
>
> Cheers,
>
>   --Arnout Kuiper
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: Igor Faynberg <[email-masked]>
Date: Thu, 08 Jul 2010 18:45:05 -0400

Arnout,

Please check with Zachary (copied here), who has been compiling the 
OAuth use cases. The idea has been to keep the use cases and the 
protocol aligned. So, if your use case is not present, please make sure 
that it is present in the next version of the draft. (Of course, the WG 
will need to support the inclusion of the material that had not been 
there before.)

 From what I saw on the list, there is no disagreement with the present 
draft.

Igor

Arnout J. Kuiper wrote:
> own protocols, which after investigation, matched the device flow in 
> the earlier versions of the OAuth2 spec exactly. I'm in favor of open 
> ------------------------------------------------------------------------
>

---

From: "Zeltsan, Zachary (Zachary)" <[email-masked]>
Date: Fri, 9 Jul 2010 11:16:27 -0500

Arnout,

The draft on the use cases that Igor mentions reflects the cases that had been discussed before the publication of the OAuth2.0 -06 version. It does include the device flow. Then there was a proposal to move the device flow from the core specification to a separate draft (see
http://www.ietf.org/mail-archive/web/oauth/current/msg03038.html ).

Subsequently, the device flow was removed from the draft draft-ietf-oauth-v2.

Zachary  
-----Original Message-----
From: Igor Faynberg [mailto:[email-masked]] 
Sent: Thursday, July 08, 2010 6:45 PM
To: Arnout J. Kuiper; Zeltsan, Zachary (Zachary)
Cc: [email-masked]
Subject: Re: [OAUTH-WG] In dire need of the device flow

Arnout,

Igor