<html><head/><body><html><head></head><body>Hi John,<br>
<br>
ressource owner password credential grant makes definitely sense in my opinion. I'm not sure for client credentials, esp. w/o id_token, as this boils down to standard OAuth to get access to the user info endpoint.<br>
<br>
Regards,<br>
Torsten.<br><br><div class="gmail_quote"><br>
<br>
John Bradley <ve7jtb@ve7jtb.com> schrieb:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre style="white-space: pre-wrap; word-wrap:break-word; font-family: sans-serif; margin-top: 0px">Last week I had several conversations with FICAM people around OAuth and Connect.<br /><br />One thing that they do and is also not uncommon in enterprises is permission access based on client credentials.<br />Think SAML Attribute query.<br /><br />We do have that in OAuth 2.0.<br /><br />One thing we don't say in Connect is how to support that grant_type.<br /><br />It seems fairly strait forward that you would have a scope of openid and any other user_info related scopes, that nonce and state are not required.<br />Returning a id_token probably doesn't make sense.<br /><br />To specify the user who is the subject we already have a way of passing the required user_id in the request object.<br /><br />I can see this being useful to compliment or replace a SAML/SOAP flow. <br /><br />We don't specifically talk about this or the Resource owner Password credentials Grant. <br /><
br />As
long as we don't do something in the core specs to preclude them we could put them in a separate profile as they are sort of special case.<br /><br />John B.<br /><br /></pre><p style="margin-top: 2.5em; margin-bottom: 1em; border-bottom: 1px solid #000"></p><pre style="white-space: pre-wrap; word-wrap:break-word; font-family: sans-serif; margin-top: 0px"><hr /><br />Openid-specs-ab mailing list<br />Openid-specs-ab@lists.openid.net<br /><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br /></pre></blockquote></div></body></html></body></html>