<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Thanks Filip!</div>
<div><br>
</div>
<div>I guess we will have to implement a similar approach.</div>
<div><br>
</div>
<div>Regards,</div>
<div>Sascha</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Filip Skokan <<a href="mailto:panva.ip@gmail.com">panva.ip@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, June 1, 2017 at 1:42 PM<br>
<span style="font-weight:bold">To: </span>Sascha Preibisch <<a href="mailto:sascha.preibisch@ca.com">sascha.preibisch@ca.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a> Ab" <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openid-specs-ab] Question on Dynamic Registration<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">
<div><span style="color: rgb(0, 0, 0); font-family: verdana, charcoal, helvetica, arial, sans-serif;">Hello Sascha,</span></div>
<div><span style="color: rgb(0, 0, 0); font-family: verdana, charcoal, helvetica, arial, sans-serif;"><br>
</span></div>
<div><span style="color: rgb(0, 0, 0); font-family: verdana, charcoal, helvetica, arial, sans-serif;">As Justin mentioned, the server must enforce this, be it by requiring the grant_types with the specific values implicit, authorization_code, or both, or by
automatically adding these </span><span style="color: rgb(0, 0, 0); font-family: verdana, charcoal, helvetica, arial, sans-serif;">to the metadata</span><span style="color: rgb(0, 0, 0); font-family: verdana, charcoal, helvetica, arial, sans-serif;"> </span><span style="color: rgb(0, 0, 0); font-family: verdana, charcoal, helvetica, arial, sans-serif;">depending
on the received response_types. </span></div>
<div><span style="color: rgb(0, 0, 0); font-family: verdana, charcoal, helvetica, arial, sans-serif;"><br>
</span></div>
<div><span style="color: rgb(0, 0, 0); font-family: verdana, charcoal, helvetica, arial, sans-serif;">Since you're asking for reference, node oidc-provider requires the values to be provided by the client in the request, other than the mentioned "when omitted"
defaults (e.g. authorization_code) there's no modifying or enriching the registration metadata. Having written both client and server i find it easier to understand that the registration metadata is incomplete (error with a clear message), rather than attempting
to read out why is my registration coming back with more than the client requested requested.</span></div>
<div><br>
</div>
<div class="gmail_extra">
<div>
<div class="gmail_signature">- Filip</div>
</div>
<br>
<div class="gmail_quote">On Thu, Jun 1, 2017 at 9:24 PM, Preibisch, Sascha H via Openid-specs-ab
<span dir="ltr"><<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>Thank you, Justin!</div>
<div><br>
</div>
<div>My issue is that our customers expect our product to adhere to the spec. Therefore I cannot build in enforcements that are not specified.</div>
<div><br>
</div>
<div>I feel that the spec. gives big room for interpretation in the area.</div>
<div><br>
</div>
<div>If you or someone else would have references of typical implementations that would help.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Sascha</div>
<div><br>
</div>
<span id="gmail-m_192734710545831853OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;border-width:1pt medium medium;border-style:solid none none;border-bottom-color:initial;border-left-color:initial;padding:3pt 0in 0in;border-top-color:rgb(181,196,223);border-right-color:initial">
<span style="font-weight:bold">From: </span>Justin Richer <<a href="mailto:jricher@mit.edu" target="_blank">jricher@mit.edu</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, May 31, 2017 at 6:12 PM<br>
<span style="font-weight:bold">To: </span>Sascha Preibisch <<a href="mailto:sascha.preibisch@ca.com" target="_blank">sascha.preibisch@ca.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.<wbr>net</a> Ab" <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.<wbr>net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openid-specs-ab] Question on Dynamic Registration<br>
</div>
<div>
<div class="gmail-h5">
<div><br>
</div>
<div>
<div style="word-wrap:break-word">The server needs to make sure that they’re consistent at the end of a successful registration. This could take the form of forcing the client to register a consistent set (response_type=code, grant_type=authorization_code)
and returning an error otherwise. Alternatively, the server could try to fill in the missing blanks for the client. Whatever the server decides is the result, it echoes back to the client, effectively dictating to the client the results of the registration.
<div><br>
</div>
<div>If the server doesn’t support the requested grant type or response type, it should probably fail the registration request. If it doesn’t, it will just fail the authorization request later on.</div>
<div><br>
</div>
<div> — Justin</div>
<div><br>
</div>
<div><br>
<div>
<blockquote type="cite">
<div>On May 31, 2017, at 1:59 PM, Preibisch, Sascha H via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.<wbr>net</a>> wrote:</div>
<br class="gmail-m_192734710545831853Apple-interchange-newline">
<div>
<div style="word-wrap:break-word;font-size:14px;font-family:Calibri,sans-serif">
<div>Hi all!</div>
<div><br>
</div>
<div>A team member and I just had a discussion about dynamic registration. Specifically about this section:</div>
<div><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__openid.net_specs_openid-2Dconnect-2Dregistration-2D1-5F0.html-23ClientMetadata&d=DwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=7gpZwgA6J-66ZzRVOZ35WfAcDwwU5gYYOjWTTglaYWc&s=CPWlAukwMe2HJIcCAWQz82lNuoJJq8D-N0tSy-ylSHc&e=" target="_blank">http://openid.net/specs/<wbr>openid-connect-registration-1_<wbr>0.html#ClientMetadata</a></div>
<div><br>
</div>
<div>We are not sure how "response_types" and "grant_types" are expected to be handled. This is not clear to us:</div>
<ul>
<li>if a client registers for any other response_type than "code", is the client required to also include a "grant_type"?</li><li>Or is it that the server has to be configured to support the matching grant_type and fail otherwise?</li><li>Should the server return the matching grant_types although the spec. says to return "authorization_code" in the case of being omitted?</li></ul>
<div>It would be great to get some clarification on that.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Sascha</div>
<div><br>
</div>
</div>
______________________________<wbr>_________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.<wbr>net</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dab&d=DwQFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=7gpZwgA6J-66ZzRVOZ35WfAcDwwU5gYYOjWTTglaYWc&s=5Qki9nltVlv269MCWWgdyr3fZbd8_P8qJ-luz7bkkbE&e=" target="_blank">http://lists.openid.net/<wbr>mailman/listinfo/openid-specs-<wbr>ab</a><br>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</div>
</span></div>
<br>
______________________________<wbr>_________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.<wbr>net</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dab&d=DwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=Paryw45nWdAwKtprMBaGP6d4NRNJtYvmb4QuYf4WzuM&s=xL0x68H5mKsn6pO9961sVlQhjLjVrvOocKoqe64dgM4&e=" rel="noreferrer" target="_blank">http://lists.openid.net/<wbr>mailman/listinfo/openid-specs-<wbr>ab</a><br>
<br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</span>
</body>
</html>