<html><head></head><body bgcolor="#FFFFFF"><div><br><br>=nat via iPhone</div><div><br>On 2012/03/14, at 7:33, "Richer, Justin P." <<a href="mailto:jricher@mitre.org">jricher@mitre.org</a>> wrote:<br><br></div>
<div></div><blockquote type="cite"><div>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
The way I read it, "code token" is its own type, and it needs to be treated </div></blockquote><div><br></div>My first take was that but the text <span class="Apple-style-span" style>goes: </span><div><span class="Apple-style-span" style><br>
</span></div><div><span class="Apple-style-span" style><span class="Apple-style-span" style><blockquote type="cite"><div><div><div><blockquote type="cite"><div><span>a distributed client with both a confidential</span><br>
<span>server-based component and a public browser-based component), <b>MUST</b></span><br><span>register each component separately as a different client</span></div></blockquote></div></div></div></blockquote><div><span class="Apple-style-span" style><span class="Apple-style-span" style><br>
</span></span></div>so looks to me that it does not allow that interpretation... <br></span></span><div><br><blockquote type="cite"><div>differently from either "code" or "token", which isn't a change. What the intent of the text is, I believe, is to keep people from using the same client id with "code" as with "token".
This would effectively be mixing public and private clients in the most normal use cases, which is the section that it's in, and that's not a good thing.
<div><br>
</div>
<div>I don't think it's actually a breaking change, but I'm less convinced of the utility of normative language here.</div>
<div><br>
</div>
<div> -- Justin</div>
<div><br>
<div>
<div>On Mar 14, 2012, at 7:02 AM, Nat Sakimura wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite"><span style>I only noticed now that rev 23 had a breaking change. it seems to</span><br style>
<span style>doesn't allow the response_type=code token unless we define another client type such as "hybrid". </span>
<div><br>
</div>
<div>This is a breaking change. <br style>
<br>
I wonder why I did not notice it till now. </div>
<div><br style>
<span style>See below.</span><br style>
<br style>
<span style>From section 2.1of</span><br style>
<a href="http://tools.ietf.org/rfcdiff?difftype=--hwdiff&url2=draft-ietf-oauth-v2-23.txt" target="_blank" style>http://tools.ietf.org/rfcdiff?difftype=--hwdiff&url2=draft-ietf-oauth-v2-23.txt</a><br style>
<br style>
<span style>"A client application consisting of multiple components, each with its</span><br style>
<span style>own client type (e.g. a distributed client with both a confidential</span><br style>
<span style>server-based component and a public browser-based component), <b>MUST</b></span><br style>
<span style>register each component separately as a different client to ensure</span><br style>
<span style>proper handling by the authorization server."</span><br style>
<br style>
<span style>Discuss.</span> <br clear="all">
<div><br>
</div>
-- <br>
Nat Sakimura (=nat)
<div>Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en</div>
<br>
</div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote>
</div>
<br>
</div>
</div></blockquote></div></div></body></html>