Subject: [OAUTH-WG] Fwd: New Version Notification for draft-ietf-oauth-incremental-authz-04.txt

From: William Denniss <[email-masked]>
Date: Sun, 3 May 2020 15:56:58 -0700

In this version, I addressed review feedback from Naveen and Aaron, which
resulted in added some new sections "Previously Granted Scopes" and
"Handling Scope Reductions" containing some advice for implementors,
 and a clarification of the OAuth metadata.

I also defined a new OAuth error code, "overbroad_scope" to have a proper
way for servers to deny requests for this reason (was already defined in
"Preventing Overbroad Authorization Requests", but didn't have a unique
error code defined).

I will be discussing these changes and the document as a whole tomorrow. I
realize this version is posted very close to that meeting, and so I do not
expect anyone to read the changes before my presentation. I will take a
minute then to briefly outline these changes at that time.

Best,
William

---------- Forwarded message ---------
From: <[email-masked]>
Date: Sun, May 3, 2020 at 3:45 PM
Subject: New Version Notification for
draft-ietf-oauth-incremental-authz-04.txt
To: William Denniss <[email-masked]>

A new version of I-D, draft-ietf-oauth-incremental-authz-04.txt
has been successfully submitted by William Denniss and posted to the
IETF repository.

Name:           draft-ietf-oauth-incremental-authz
Revision:       04
Title:          OAuth 2.0 Incremental Authorization
Document date:  2020-05-03
Group:          oauth
Pages:          11
URL:
https://www.ietf.org/internet-drafts/draft-ietf-oauth-incremental-authz-04.txt
Status:
https://datatracker.ietf.org/doc/draft-ietf-oauth-incremental-authz/
Htmlized:
https://tools.ietf.org/html/draft-ietf-oauth-incremental-authz-04
Htmlized:
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-incremental-authz
Diff:
https://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-incremental-authz-04

Abstract:
   OAuth 2.0 authorization requests that include every scope the client
   might ever need can result in over-scoped authorization and a sub-
   optimal end-user consent experience.  This specification enhances the
   OAuth 2.0 authorization protocol by adding incremental authorization,
   the ability to request specific authorization scopes as needed, when
   they're needed, removing the requirement to request every possible
   scope that might be needed upfront.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat