Subject: [kitten] Edit on OAuth-SASL -17

From: Justin Richer <[email-masked]>
Date: Thu, 13 Nov 2014 15:56:49 -1000

As brought up in the Kitten WG at IETF91, there’s a small change that should be made to the OAuth SASL draft in order to align it with OpenID Connect. Specifically, section “3.2.2” refers to the “issue” element of OpenID Connect, which should actually be “iss” (short for issuer). The “iss” is an absolute URL that uniquely identifies the issuing server in an OpenID Connect context, and this URL is usable as the root identifier for discovery of service information. More importantly to this section, it can be used by clients to differentiate which client identifier to use. We suggest the following text change:

CURRENT:

   Since clients may interact with a number of application servers, such
   as email servers and XMPP servers, they need to have a way to
   determine whether dynamic client registration has been performed
   already and whether an already available refresh token can be re-used
   to obtain an access token for the desired resource server.  This
   specification RECOMMENDs that a client uses the information in the
   'issue' element to make this determination.

NEW:

   Since clients may interact with a number of application servers, such
   as email servers and XMPP servers, they need to have a way to
   determine the appropriate set of tokens and credentials to use for
   each server, whether dynamic client registration has been performed
   already, and whether an already available refresh token can be re-used
   to obtain an access token for the desired resource server.  This
   specification RECOMMENDs that a client uses the information in the
   'iss' element defined in OpenID Connect Core [OIDC] to make this 
   determination, where available.

I would also suggest moving the JSON reference from RFC4627 to RFC7159.

 — Justin

---

From: Bill Mills <[email-masked]>
Date: Fri, 14 Nov 2014 05:23:39 +0000 (UTC)

Fixed it mostly.  Discovery doesn't tell you what credential types are needed though, which perhaps it needs to...  but the assumption is that the AS will issue the right tokens for the RS.  I left that bit out. 

     On Thursday, November 13, 2014 5:58 PM, Justin Richer <[email-masked]> wrote:

CURRENT:

NEW:

 — Justin
_______________________________________________
Kitten mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/kitten