Ticket created as <div><br></div><div><a href="https://bitbucket.org/openid/connect/issue/135/standard-61-userinfo-text-clarification-on">https://bitbucket.org/openid/connect/issue/135/standard-61-userinfo-text-clarification-on</a></div>
<div><br></div><div>=nat<br><br><div class="gmail_quote">On Fri, Sep 30, 2011 at 12:50 AM, Mike Jones <span dir="ltr"><<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p>Standard currently says in the access_token description in
<a href="http://openid.net/specs/openid-connect-standard-1_0.html#anchor19" target="_blank">6.1</a>: “If the client is using the HTTP GET method, it SHOULD send the access token in the authorization header.” I would add to this: “The access_token MAY alternatively be sent
in the message body, as described in the OAuth.2.0.Bearer specification.”<u></u><u></u></p>
<p><u></u> <u></u></p><font color="#888888">
<p> -- Mike<u></u><u></u></p></font><div><div></div><div class="h5">
<p><u></u> <u></u></p>
<p>-----Original Message-----<br>
From: sakimura [mailto:<a href="mailto:sakimura@gmail.com" target="_blank">sakimura@gmail.com</a>] <br>
Sent: Thursday, September 29, 2011 1:29 AM<br>
To: Mike Jones<br>
Cc: Anthony Nadalin; <a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a><br>
Subject: RE: [Openid-specs-ab] UserInfo Request</p>
<p><u></u> <u></u></p>
<p>That's our intention from the beginning so the text apparently is not working.<u></u><u></u></p>
<p><u></u> <u></u></p>
<p>Perhaps could you suggest a text?<u></u><u></u></p>
<p><u></u> <u></u></p>
<p>I will make a ticket at issue tracker.<u></u><u></u></p>
<p><u></u> <u></u></p>
<p>=nat<u></u><u></u></p>
<p><u></u> <u></u></p>
<p>On Thu, 29 Sep 2011 03:00:37 +0000, Mike Jones wrote:<u></u><u></u></p>
<p>> I agree with Tony here. He and I both read the Basic and Standard
<u></u><u></u></p>
<p>> specs to see if the parameter could be passed in the body, and to both
<u></u><u></u></p>
<p>> of us, it appeared that OpenID Connect (as a profile of OAuth 2.0) was
<u></u><u></u></p>
<p>> intentionally ruling this out.<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>> Nat, could you maybe add an issue in the issue tracker to clean up
<u></u><u></u></p>
<p>> this language, at least in the Standard spec, to make it clear that
<u></u><u></u></p>
<p>> all the OAuth 2.0 parameter passing methods can be used? (Breno should
<u></u><u></u></p>
<p>> like this too. J)<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>> Thanks,<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>> -- Mike<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>> FROM: <a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a><u></u><u></u></p>
<p>> [mailto:<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>] ON BEHALF OF Anthony
<u></u><u></u></p>
<p>> Nadalin<u></u><u></u></p>
<p>> SENT: Wednesday, September 28, 2011 7:52 PM<u></u><u></u></p>
<p>> TO: Nat Sakimura<u></u><u></u></p>
<p>> CC: <a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a><u></u><u></u></p>
<p>> SUBJECT: Re: [Openid-specs-ab] UserInfo Request<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>> I think it's confusing the way it reads as it does not give me an
<u></u><u></u></p>
<p>> option to use the OAUTH Core, so how would I know????<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>> FROM: Nat Sakimura [mailto:<a href="mailto:sakimura@gmail.com" target="_blank">sakimura@gmail.com</a>]<u></u><u></u></p>
<p>> SENT: Wednesday, September 28, 2011 5:21 PM<u></u><u></u></p>
<p>> TO: Anthony Nadalin<u></u><u></u></p>
<p>> CC: <a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a><u></u><u></u></p>
<p>> SUBJECT: Re: [Openid-specs-ab] UserInfo Request<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>> I think it does. OAuth allows access_token to be used in HTTP header,
<u></u><u></u></p>
<p>> GET param, and POST param (body), and the text goes "Access tokens
<u></u><u></u></p>
<p>> sent in the authorization header must be BEARER TOKENS <u></u>
<u></u></p>
<p>> [1][OAuth.2.0.Bearer]. If the client is using the HTTP GET method, it
<u></u><u></u></p>
<p>> SHOULD send the access token in the authorization header." so it is<u></u><u></u></p>
<p>> saying:<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>> 1. If the access_token is sent in the HTTP header, it has to use the
<u></u><u></u></p>
<p>> Bearer tokens scheme.<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>> 2. If the request is GET, it has to use HTTP header to send the
<u></u><u></u></p>
<p>> access_token.<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>> (3. Implicitly, because OAuth allows - do as the OAuth says for the
<u></u><u></u></p>
<p>> POST, i.e., Body.)<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>> Are you suggesting that we should add 3. so that people does not have
<u></u><u></u></p>
<p>> to read OAuth.2.0.Bearer?<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>> =nat<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>> On Thu, Sep 29, 2011 at 7:27 AM, Anthony Nadalin wrote:<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>> In <a href="http://openid.net/specs/openid-connect-standard-1_0.html#anchor19" target="_blank">
<span style="color:windowtext;text-decoration:none">http://openid.net/specs/openid-connect-standard-1_0.html#anchor19</span></a><u></u><u></u></p>
<p>> [3] it does not call out the use of the body as an option for the
<u></u><u></u></p>
<p>> access token, since access tokens can get large there may be issues
<u></u><u></u></p>
<p>> using only the header, the bearer token specification allows usage of
<u></u><u></u></p>
<p>> the body, so should the openid standard specification.<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>> _______________________________________________<u></u><u></u></p>
<p>> Openid-specs-ab mailing list<u></u><u></u></p>
<p>> <a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank"><span style="color:windowtext;text-decoration:none">Openid-specs-ab@lists.openid.net</span></a> [4]<u></u><u></u></p>
<p>> <a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">
<span style="color:windowtext;text-decoration:none">http://lists.openid.net/mailman/listinfo/openid-specs-ab</span></a> [5]<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>> --<u></u><u></u></p>
<p>> Nat Sakimura (=nat)<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>> Chairman, OpenID Foundation<u></u><u></u></p>
<p>> <a href="http://nat.sakimura.org/" target="_blank"><span style="color:windowtext;text-decoration:none">http://nat.sakimura.org/</span></a> [6]<u></u><u></u></p>
<p>> @_nat_en<u></u><u></u></p>
<p>><u></u> <u></u></p>
<p>><u></u> <u></u></p>
<p>><u></u> <u></u></p>
<p>> Links:<u></u><u></u></p>
<p>> ------<u></u><u></u></p>
<p>> [1]<u></u><u></u></p>
<p>> <a href="http://openid.net/specs/openid-connect-standard-1_0.html#OAuth.2.0.Bea" target="_blank">
<span style="color:windowtext;text-decoration:none">http://openid.net/specs/openid-connect-standard-1_0.html#OAuth.2.0.Bea</span></a><u></u><u></u></p>
<p>> rer<u></u><u></u></p>
<p>> [2] <a href="mailto:tonynad@microsoft.com" target="_blank"><span style="color:windowtext;text-decoration:none">mailto:tonynad@microsoft.com</span></a><u></u><u></u></p>
<p>> [3] <a href="http://openid.net/specs/openid-connect-standard-1_0.html#anchor19" target="_blank">
<span style="color:windowtext;text-decoration:none">http://openid.net/specs/openid-connect-standard-1_0.html#anchor19</span></a><u></u><u></u></p>
<p>> [4] <a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank"><span style="color:windowtext;text-decoration:none">mailto:Openid-specs-ab@lists.openid.net</span></a><u></u><u></u></p>
<p>> [5] <a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">
<span style="color:windowtext;text-decoration:none">http://lists.openid.net/mailman/listinfo/openid-specs-ab</span></a><u></u><u></u></p>
<p>> [6] <a href="http://nat.sakimura.org/" target="_blank"><span style="color:windowtext;text-decoration:none">http://nat.sakimura.org/</span></a><u></u><u></u></p>
<p><u></u> <u></u></p>
<p><u></u> <u></u></p>
</div></div></div>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Nat Sakimura (=nat)<div>Chairman, OpenID Foundation<br><a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>@_nat_en</div><br>
</div>