Thanks Chuck. <div><br></div><div>Comments inline: <br><br><div class="gmail_quote">On Tue, Jul 19, 2011 at 3:38 AM, Chuck Mortimore <span dir="ltr"><<a href="mailto:cmortimore@salesforce.com">cmortimore@salesforce.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div>
<font face="Lucida Grande"><span style="font-size:11pt">Sorry I’ve been checked out for a bit. Swamped at work and just catching up. Feedback on the latest drafts:<br>
<br>
General: I know it’s well understood, but I’ll re-iterate that the current document organization is extremely hard to follow. I’d prefer one document for core/minimal, and additional documents for disco, registration, and session that layer on top. I’d also consider moving the request file method to a separate doc. In that light, I don’t understand the existence of “framework” at all. <br>
</span></font></div></blockquote><div><br></div><div>We are fully aware of the problems of the current document organization. We are going to fix it in a few weeks time. </div><div>Generally, we will put a spot light on the Basic HTTP Binding and call it either "OpenID Connect" or "OpenID Connect Basic" or something. </div>
<div>That will be the document that a developer who wants to do twitter like simple thing should read. </div><div><br></div><div>Whether to have "request" and "request_url" parameters in it is a point to debate. I suppose it could be moved to "OpenID Connect Professional" etc. spec. Appropriately renamed version of the framework spec will be referenced from there. </div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div><font face="Lucida Grande"><span style="font-size:11pt">
<br>
General: Let’s add some language on when/why to choose the various request methods. <br></span></font></div></blockquote><div><br></div><div>Good idea. </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div><font face="Lucida Grande"><span style="font-size:11pt">
<br>
http-redirect 3.1.1: would like to see display=touch. There is precedent for this in at least the salesforce and facebook implementations, as well as the draft submission david put out awhile back <br></span></font></div>
</blockquote><div><br></div><div>Seems to be a good idea, too. </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div><font face="Lucida Grande"><span style="font-size:11pt">
<br>
http-redirect 3.1.1: The overlap between prompt, pape, and max_auth_age in the id_token is confusing. I like the simplicity of prompt, but need the flexability of max_auth_age <br></span></font></div></blockquote><div>
<br></div><div>Do you have a text suggestion? </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div><font face="Lucida Grande"><span style="font-size:11pt">
<br>
http-redirect 3.1.1: id_token_audience is never really defined<br></span></font></div></blockquote><div><br></div><div>Need to fix. </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div><font face="Lucida Grande"><span style="font-size:11pt">
<br>
http-redirect 3.1.1: select_ account seems references “the account in the request” but I can’t find any means of specifying an account in a request<br>
<br></span></font></div></blockquote><div><br></div><div>Need to add text. </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div><font face="Lucida Grande"><span style="font-size:11pt">
http-redirect 3.1.5: I don’t think we should be defining secret_type in this spec. I’d rather see this inherit from the assertion work in core oauth. <br></span></font></div></blockquote><div><br></div><div>That's actually marked as TODO right below it. </div>
<div>We need to fix it. </div><div>Mike, do you have any preference or text? </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div><font face="Lucida Grande"><span style="font-size:11pt">
<br>
http-redirect 3.1.1: It’s not clear the difference between the query parameters method and the request parameter method. Are all the values from the request parameter supposed to be serializable as query params, or is this just the simplest possible request and hence the request param can be eliminated?<br>
</span></font></div></blockquote><div><br></div><div>When using "request" parameter, query parameter is just there to be OAuth 2.0 compliant. You just make the simplest possible query parameters just to be compliant. We probably need clarification text. </div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div><font face="Lucida Grande"><span style="font-size:11pt">
<br>
session: we don’t ever stop to explain what an id_token is in relation to an access_token and why/when you’d want to use one. Should be covered in terminology.<br></span></font></div></blockquote><div><br></div><div>Points taken. </div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div><font face="Lucida Grande"><span style="font-size:11pt">
<br>
http-redirect general: If we want a minimal flow, and then layered documents like session, there are some odd dependencies between the two. Http-redirect references and uses id_tokens without any explanation. Only when you get to session do you really get some info on what they are.<br>
</span></font></div></blockquote><div><br></div><div>id token is there not only for session management. We need text to explain what it really is in the Http-redirect. </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div><font face="Lucida Grande"><span style="font-size:11pt">
<br>
-cmort<br>
<br>
</span></font>
</div>
<br>_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br>Nat Sakimura (=nat)<div>Chairman, OpenID Foundation<br><a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>@_nat_en</div><br>
</div>