I'm not sure. While I've seen OAuth interop really being hampered by that extension not being implemented in many libraries, and I generally think it's a good thing to report errors as detailed as possible, this does seem a very Un-OpenID-thing to do. They specify only two error conditions: "the user didn't want to log in" and "we can't log in the user without showing them a UI" (and this includes the AX extension). Of course, a lot more can go wrong, and there doesn't seem to be a notion in OpenID that this would be communicated, through a browser redirect, to the consumer. Perhaps the unspoken rule is that the redirect just doesn't happen when something goes wrong? In that case, the OP would just show a descriptive error page to the user? I don't know...<br>
<br>Dirk.<br><br><div class="gmail_quote">On Fri, Nov 21, 2008 at 4:04 PM, Allen Tom <span dir="ltr"><<a href="mailto:atom@yahoo-inc.com">atom@yahoo-inc.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#000000">
How about if the openid.oauth.scope response parameter defined in
Section 9 be changed to be a more generic OAuth status indicator? It
can be used to indicate which scopes were authorized in the success
case, or it can be used as status/problem indicator if there was an
error.<br>
<br>
Perhaps the allowed values can be the same as the values defined in the
ProblemReporting extension.<br>
<a href="http://oauth.pbwiki.com/ProblemReporting" target="_blank">http://oauth.pbwiki.com/ProblemReporting</a><br><font color="#888888">
<br>
Allen</font><div><div></div><div class="Wj3C7c"><br>
<br>
<br>
<br>
<br>
Dirk Balfanz wrote:
<blockquote type="cite"><br>
<br>
<div class="gmail_quote">On Wed, Nov 19, 2008 at 2:31 PM, Allen Tom <span dir="ltr"><<a href="mailto:atom@yahoo-inc.com" target="_blank">atom@yahoo-inc.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#000000">Since the new hybrid draft
spec doesn't affect the OpenID association
method, this is moot.<br>
<br>
However, the spec should mention what SPs should do if the CK is
invalid (or doesn't match the realm) in the OpenID authentication
request. Presumably, the SP should continue servicing the OpenID
portion of the request, however, the response should indicate why the
OAuth portion of the request failed.<br>
</div>
</blockquote>
<div><br>
</div>
<div>How about, to mimic what happens with association handles, we
can return in the response an openid.oauth.invalid_consumer parameter
instead of openid.oauth.consumer? It would mean that either the CK was
just wrong or that it didn't match the realm. Although at this point it
starts to get pretty complicated. </div>
<div><br>
</div>
<div>Does this error condition really need to be communicated back to
the RP? For development etc., it might be enough to just show an error
page to the user explaining what happened. </div>
<div><br>
</div>
<div>Dirk.</div>
<div><br>
</div>
<div> </div>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#000000"><font color="#888888"><br>
Allen</font>
<div><br>
<br>
<br>
Dirk Balfanz wrote:
<blockquote type="cite"><br>
<div class="gmail_quote">
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><br>
</blockquote>
</div>
I'd recommend an error consistent with Section 8.2.4 in the OpenID 2.0
spec, with a new error_code value indicating that the either the CK or
the realm was invalid. There may actually need to be 2 errors, one to
indicate that the CK is invalid, and another to indicate that the CK is
not valid for the realm.<br>
<br>
<a href="http://openid.net/specs/openid-authentication-2_0.html#anchor20" target="_blank">http://openid.net/specs/openid-authentication-2_0.html#anchor20</a><br>
</blockquote>
<div><br>
</div>
<div>But Section 8.2 is about the association response. In the
auth
response, we currently only have cancel or setup_needed. If we invent
another error condition there, we're no longer a pure "extension". </div>
<div> </div>
</div>
</blockquote>
<br>
</div>
</div>
</blockquote>
</div>
<br>
</blockquote>
<br>
</div></div></div>
</blockquote></div><br>