<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">They could but that would not be in the spirit of OAuth.<div><br></div><div>I think the idea of pre-regestring what attributes a RP gets is one that has caused problems in SAML. It may work in an enterprise, but we now have to have RP spoof multiple entity_id/client_id to be able to request the correct attributes.</div><div><br></div><div>Remember we are trying to build privacy preserving into the technology, that involves the principal of minimal disclosure. </div><div><br></div><div>Pre-regestring attributes per client_id sounds like a bad idea as compared to a small number of default scopes for the protected resource. </div><div><br></div><div>John<br><div><div>On 2011-08-17, at 9:14 PM, Allen Tom wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">The scopes that the client is asking for could be bound to the client_id. This assumes that the RP pre-registered with the OP. <div><br></div><div>That being said, I think it's probably easier for client developers if they're able to dynamically specify the scopes that they want.</div>
<div><br></div><div>Allen</div><div><br></div><div><div><div><br><div class="gmail_quote">On Wed, Aug 17, 2011 at 5:19 PM, John Bradley <span dir="ltr"><<a href="mailto:ve7jtb@ve7jtb.com">ve7jtb@ve7jtb.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div style="word-wrap:break-word">Yes but the question is how you ask for authorization.<div><br></div><div>If there is only one scope then you can't ask for a subset. At least Facebook dosen't want to give email by default. </div>
<div><br></div><div><br></div></div></blockquote></div></div></div></div>
</blockquote></div><br></div></body></html>