<HTML>
<HEAD>
<TITLE>Re: [Openid-specs-ab] Few more connect comments.</TITLE>
</HEAD>
<BODY>
<FONT FACE="Lucida Grande"><SPAN STYLE='font-size:11pt'><BR>
<BR>
<BR>
On 7/18/11 11:57 PM, "Nat Sakimura" <<a href="sakimura@gmail.com">sakimura@gmail.com</a>> wrote:<BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Lucida Grande"><SPAN STYLE='font-size:11pt'><BR>
<BR>
On Tue, Jul 19, 2011 at 2:42 PM, Chuck Mortimore <<a href="cmortimore@salesforce.com">cmortimore@salesforce.com</a>> wrote:<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Lucida Grande"><SPAN STYLE='font-size:11pt'>Few more comments:<BR>
<BR>
http-redirect: Can you only get an id_token with the request method?<BR>
</SPAN></FONT></BLOCKQUOTE><FONT FACE="Lucida Grande"><SPAN STYLE='font-size:11pt'><BR>
You should be able to get even in query string method. <BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Lucida Grande"><SPAN STYLE='font-size:11pt'><BR>
session 3.2.3: We should consider how this relates to the token revocation draft, given both Google and Salesforce will be shipping<BR>
</SPAN></FONT></BLOCKQUOTE><FONT FACE="Lucida Grande"><SPAN STYLE='font-size:11pt'><BR>
Good point. Could you point me to the relevant doc/section? <BR>
<BR>
<BR>
</SPAN></FONT></BLOCKQUOTE><FONT FACE="Lucida Grande"><SPAN STYLE='font-size:11pt'><a href="http://tools.ietf.org/html/draft-lodderstedt-oauth-revocation-02">http://tools.ietf.org/html/draft-lodderstedt-oauth-revocation-02</a><BR>
<BR>
Google and ourselves both have added jsonp support as well.<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Lucida Grande"><SPAN STYLE='font-size:11pt'> <BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Lucida Grande"><SPAN STYLE='font-size:11pt'><BR>
client-registration 4.1: would like to see PEM encoded x509 as an option for clients that can't host a jwk<BR>
</SPAN></FONT></BLOCKQUOTE><FONT FACE="Lucida Grande"><SPAN STYLE='font-size:11pt'><BR>
Good. I wanted that as well. Actually, it went missing among editing, I guess. I remember it was there at some point and there were no decisions to remove it. <BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Lucida Grande"><SPAN STYLE='font-size:11pt'><BR>
client-registration: I believe we need to protect the service itself with oauth - almost all of us have applications owned by a developer account, and hence we need some authentication to perform the binding to that account<BR>
</SPAN></FONT></BLOCKQUOTE><FONT FACE="Lucida Grande"><SPAN STYLE='font-size:11pt'><BR>
I think the authn should be optional. To be truly dynamic, we should not require pre-registration of the developer account. <BR>
<BR>
</SPAN></FONT></BLOCKQUOTE><FONT FACE="Lucida Grande"><SPAN STYLE='font-size:11pt'>Agreed, but it’s not covered at all at the moment. None of the current providers would know how to server an admin interface for the resulting clients.<BR>
<BR>
-cmort<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Lucida Grande"><SPAN STYLE='font-size:11pt'><BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Lucida Grande"><SPAN STYLE='font-size:11pt'><BR>
-cmort <BR>
<BR>
_______________________________________________<BR>
Openid-specs-ab mailing list<BR>
<a href="Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><BR>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><BR>
<BR>
</SPAN></FONT></BLOCKQUOTE><FONT FACE="Lucida Grande"><SPAN STYLE='font-size:11pt'><BR>
<BR>
</SPAN></FONT></BLOCKQUOTE>
</BODY>
</HTML>