[Openid-specs-ab] Updates to the UserInfo Endpoint spec
ve7jtb at ve7jtb.com
Sat Jul 2 01:07:50 UTC 2011
I am concerned about breaking current implementations, by being overly restrictive.
If Facebook wanted to use the current open-graph endpoint, I wouldn't want to preclude it.
We could make /userinfo a SHOULD, but I think a MUST is too strong.
On 2011-07-01, at 8:21 PM, George Fletcher wrote:
> Hi John,
> I'm fine with the discovery spec defining the endpoints.. I was thinking specifically of something like /userinfo, like the OAuth2 spec defines /authorize and /token path portions of the endpoint. Do we want that part variable on an implementation by implementation basis?
> On 7/1/11 6:39 PM, John Bradley wrote:
>> I think it is better to leave the path to the IdP. The discovery document for the IdP will list the endpoint URL.
>> I would not assume that the host is necessarily the same as the token or other endpoints.
>> John B.
>> On 2011-07-01, at 6:28 PM, George Fletcher wrote:
>>> I updated the text regarding the UserInfo request to say that it is an OAuth2 protected resource supporting the Bearer Token spec. I also changed the SHOULD to a MUST in the response text requiring the JSON object to compile with the specified schema if the schema parameter requests "openid". Also did some clean ups in the referenced specs information.
>>> One thing I just noticed is that we don't specify the path of the UserInfo endpoint. Do we want to do so?
>>> Openid-specs-ab mailing list
>>> Openid-specs-ab at lists.openid.net
> Chief Architect AIM: gffletch
> Identity Services Engineering Work: george.fletcher at teamaol.com
> AOL Inc. Home: gffletch at aol.com
> Mobile: +1-703-462-3494 Blog: http://practicalid.blogspot.com
> Office: +1-703-265-2544 Twitter: http://twitter.com/gffletch
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Openid-specs-ab