Re: [OAUTH-WG] Proposal for OAuth dynamic client registration

2010-08-12 Thread Stefanie Dronia
Hi Christian, thanks for clarification. Regards, Stefanie Am 11.08.2010 18:22, schrieb Christian Scholz: Hi! Am 11.08.10 16:36, schrieb Stefanie Dronia: Hallo Eve, I read your proposal, too. Thanks for providing it. Some questions: # first part of chapter 2 # enchanced OAuth RS, A

Re: [OAUTH-WG] Proposal for OAuth dynamic client registration

2010-08-11 Thread Eve Maler
Great comments; thanks to Christian for responding. To answer just a couple of more points that I don't think got addressed yet: Yes, we would very much like for dynamic client registration to become a work item of this group. (Do we need to take any steps other than stating so in this email?

Re: [OAUTH-WG] Proposal for OAuth dynamic client registration

2010-08-11 Thread Christian Scholz
Hi! Am 11.08.10 16:36, schrieb Stefanie Dronia: > Hallo Eve, > > I read your proposal, too. Thanks for providing it. > > Some questions: > # first part of chapter 2 > # enchanced OAuth RS, AS and client are mentioned. Does the > enhancement just denote, that they support dynamic client regis

Re: [OAUTH-WG] Proposal for OAuth dynamic client registration

2010-08-11 Thread Torsten Lodderstedt
Am 11.08.2010 um 17:40 schrieb Christian Scholz : > Am 11.08.10 17:31, schrieb Torsten Lodderstedt: >> >>> How is a UMA requestor envisioned to discover the auth server? >>> >>> On the Host side the user can tell it which AM (in UMA terms it's an >>> Authorization Manager,

Re: [OAUTH-WG] Proposal for OAuth dynamic client registration

2010-08-11 Thread Torsten Lodderstedt
Am 11.08.2010 um 17:40 schrieb Christian Scholz : > Am 11.08.10 17:31, schrieb Torsten Lodderstedt: >> >>> How is a UMA requestor envisioned to discover the auth server? >>> >>> On the Host side the user can tell it which AM (in UMA terms it's an >>> Authorization Manager,

Re: [OAUTH-WG] Proposal for OAuth dynamic client registration

2010-08-11 Thread Christian Scholz
Am 11.08.10 17:31, schrieb Torsten Lodderstedt: > >>> >>> >> >>> How is a UMA requestor envisioned to discover the auth server? >> >> On the Host side the user can tell it which AM (in UMA terms it's an >> Authorization Manager, some sort of extended AS) to use or it might be >> discovered via web

Re: [OAUTH-WG] Proposal for OAuth dynamic client registration

2010-08-11 Thread Torsten Lodderstedt
>> >> > >> How is a UMA requestor envisioned to discover the auth server? > > On the Host side the user can tell it which AM (in UMA terms it's an > Authorization Manager, some sort of extended AS) to use or it might be > discovered via webfinger or similar means. > > The process for requeste

Re: [OAUTH-WG] Proposal for OAuth dynamic client registration

2010-08-11 Thread Christian Scholz
Hi! Am 11.08.10 12:40, schrieb Torsten Lodderstedt: > Eve, > > thank you for writting this document. I consider it a good starting > point for a discussion about client registration and discovery. Will > you propose this as a WG item? I think that's the plan as it is more related more to OAuth i

Re: [OAUTH-WG] Proposal for OAuth dynamic client registration

2010-08-11 Thread Christian Scholz
Hi! Thanks for the feedback! :-) Am 11.08.10 10:20, schrieb Lukas Rosenstock: > Nice to see this draft! > I've just read it and would like to provide some feedback: > > 1) redirect_url vs. redirect_uri: In different flows, different terms > have been used. I think that should be consistent and i

Re: [OAUTH-WG] Proposal for OAuth dynamic client registration

2010-08-11 Thread Stefanie Dronia
Hallo Eve, I read your proposal, too. Thanks for providing it. Some questions: # first part of chapter 2 # enchanced OAuth RS, AS and client are mentioned. Does the enhancement just denote, that they support dynamic client registration or have any further requirements to be fulfilled by th

Re: [OAUTH-WG] Proposal for OAuth dynamic client registration

2010-08-11 Thread Torsten Lodderstedt
Am 11.08.2010 um 12:40 schrieb Torsten Lodderstedt : > Eve, > > thank you for writting this document. I consider it a good starting point for > a discussion about client registration and discovery. Will you propose this > as a WG item? > > My comments & questions: > > You propose a host-m

Re: [OAUTH-WG] Proposal for OAuth dynamic client registration

2010-08-11 Thread Torsten Lodderstedt
Eve, thank you for writting this document. I consider it a good starting point for a discussion about client registration and discovery. Will you propose this as a WG item? My comments & questions: You propose a host-meta based discovery of the registration endpoint on the authz server. Could

Re: [OAUTH-WG] Proposal for OAuth dynamic client registration

2010-08-11 Thread Lukas Rosenstock
Nice to see this draft! I've just read it and would like to provide some feedback: 1) redirect_url vs. redirect_uri: In different flows, different terms have been used. I think that should be consistent and it should be uri. 2) Data formats for requests: This spec uses JSON for everything. The co

[OAUTH-WG] Proposal for OAuth dynamic client registration

2010-08-10 Thread Eve Maler
Folks-- The UMA group has produced the following I-D as input to the OAuth discovery/registration/binding discussion. We wanted to set forth our requirements (knowing that there may be other requirements from the wider community) and propose some solutions that meet them. If further discussion