<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">In a number of cases I expect that the OP will generate a JWT as the access token.<div><br></div><div>MAC tokens are mostly about being able to save the access token as a cookie. I don't know that they add much.</div><div><br></div><div>I am OK with leaving it open to extension. Though I a proper proof key mechanism for JWT is probably the way to go..</div><div><br></div><div>John<br><div><div>On 2011-09-06, at 3:04 PM, Andreas Åkre Solberg wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On 3. sep.2011, at 06:34, Nat Sakimura wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">While I sympathise with the need for flexibility, for the interoperability, profiling narrowly would be a good thing. </span></blockquote><div><br></div><div>Interoperability is super important, but it does not need to be in conflict with interoperability.</div><div><br></div><div>I'm in favor of spec-ing things like this:</div><div><br></div><div>Both Provider and RP MUST support Bearer Tokens. Both MAY support additional typen_types. A Provider MUST never issue other token types than "Bearer", unless the Provider has knowledge of which token_types the RP supports (using out of band negotiation, in example metadata).</div><br><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div>As to the criticism [1], I would not actually care. It is just the matter of using signed and possibly encrypted JWT as access_token if you wanted more security. </div></span></blockquote><div><br></div><div>What do you mean? Do you mean that the RP will create the JWT, or that the bearer token received by the RP is a JWT generated by the OP.</div><br></div><div><br></div></div>_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>http://lists.openid.net/mailman/listinfo/openid-specs-ab<br></blockquote></div><br></div></body></html>