<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText"><b><span style="color:red">Brian</span></b>, last week the working group made this request of you to drive a discussion on this issue:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">It is this way because currently Google always requires the redirect_uri value.
<b><span style="color:red">Brian</span></b>, could you start a thread on the list with Breno and Naveen asking if they'd be OK with relaxing the spec to allow the redirect_uri parameter not to be present when only one redirect_uri is registered?<o:p></o:p></p>
<p class="MsoPlainText"><o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">Similarly, for the same reasons, we currently require sending the redirect_uri to the token endpoint even in cases where OAuth doesn't require it because we already have a single registered redirect_uri. We should
probably discuss this at the same time.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Could you try to get that going this week? We’d like to decide soon whether any changes will be made in response to this issue.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> Thanks,<o:p></o:p></p>
<p class="MsoPlainText"> -- Mike<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: openid-specs-ab-bounces@lists.openid.net [mailto:openid-specs-ab-bounces@lists.openid.net] On Behalf Of Brian Campbell<br>
Sent: Friday, October 19, 2012 2:13 PM<br>
To: openid-specs-ab@lists.openid.net<br>
Subject: [Openid-specs-ab] [openid/connect] Inconsistent treatment of redirect_uri parameter (issue #669)</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">--- you can reply above this line ---<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">New issue 669: Inconsistent treatment of redirect_uri parameter
<a href="https://bitbucket.org/openid/connect/issue/669/inconsistent-treatment-of-redirect_uri">
<span style="color:windowtext;text-decoration:none">https://bitbucket.org/openid/connect/issue/669/inconsistent-treatment-of-redirect_uri</span></a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Brian Campbell:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">OAuth 2.0 (RFC 6749!) defines redirect_uri as an optional parameter in an authorization request in cases where the client has a single unambiguous redirect_uri registered with the AS and then only requires it in an access token request
when it had previously been included in the corresponding authorization request [1].<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The treatment of redirect_uri in the Connect specs isn't always consistent with OAuth, however, and is also somewhat internally inconsistent though different Connect specs.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Standard has redirect_uri required in the authorization request [2] while allowing it to be omitted in the token request [3]. Messages has it required [4] as does Basic [5] and Implicit [6]. The wording in Registration seem to suggest
that it's required [7].<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I'd argue that Connect should be consistent with the OAuth for redirect_uri treatment. It should be optional/required under the same conditions as in OAuth (unless there is some compelling reason to differ). It might make sense to just
defer directly to OAuth for the core parameter definitions and only define in Connect additional parameters or those that do need to be treated differently.
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">[1] <a href="http://tools.ietf.org/html/rfc6749#section-3.1.2.3">
<span style="color:windowtext;text-decoration:none">http://tools.ietf.org/html/rfc6749#section-3.1.2.3</span></a><o:p></o:p></p>
<p class="MsoPlainText"><a href="http://tools.ietf.org/html/rfc6749#section-4.1.1"><span style="color:windowtext;text-decoration:none">http://tools.ietf.org/html/rfc6749#section-4.1.1</span></a><o:p></o:p></p>
<p class="MsoPlainText"><a href="http://tools.ietf.org/html/rfc6749#section-4.1.3"><span style="color:windowtext;text-decoration:none">http://tools.ietf.org/html/rfc6749#section-4.1.3</span></a><o:p></o:p></p>
<p class="MsoPlainText"><a href="http://tools.ietf.org/html/rfc6749#section-4.2.1"><span style="color:windowtext;text-decoration:none">http://tools.ietf.org/html/rfc6749#section-4.2.1</span></a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">[2] <a href="http://openid.net/specs/openid-connect-standard-1_0.html#rf_prep">
<span style="color:windowtext;text-decoration:none">http://openid.net/specs/openid-connect-standard-1_0.html#rf_prep</span></a><o:p></o:p></p>
<p class="MsoPlainText">[3] <a href="http://openid.net/specs/openid-connect-standard-1_0.html#anchor9">
<span style="color:windowtext;text-decoration:none">http://openid.net/specs/openid-connect-standard-1_0.html#anchor9</span></a><o:p></o:p></p>
<p class="MsoPlainText">[4] <a href="http://openid.net/specs/openid-connect-messages-1_0.html#auth_req">
<span style="color:windowtext;text-decoration:none">http://openid.net/specs/openid-connect-messages-1_0.html#auth_req</span></a><o:p></o:p></p>
<p class="MsoPlainText">[5] <a href="http://openid.net/specs/openid-connect-basic-1_0.html#rf_prep">
<span style="color:windowtext;text-decoration:none">http://openid.net/specs/openid-connect-basic-1_0.html#rf_prep</span></a><o:p></o:p></p>
<p class="MsoPlainText">[6] <a href="http://openid.net/specs/openid-connect-implicit-1_0.html#rf_prep">
<span style="color:windowtext;text-decoration:none">http://openid.net/specs/openid-connect-implicit-1_0.html#rf_prep</span></a><o:p></o:p></p>
<p class="MsoPlainText">[7] <a href="http://openid.net/specs/openid-connect-registration-1_0.html#anchor3">
<span style="color:windowtext;text-decoration:none">http://openid.net/specs/openid-connect-registration-1_0.html#anchor3</span></a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">--<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">This is an issue notification from bitbucket.org. You are receiving this either because you are the owner of the issue, or you are following the issue.<o:p></o:p></p>
<p class="MsoPlainText">_______________________________________________<o:p></o:p></p>
<p class="MsoPlainText">Openid-specs-ab mailing list<o:p></o:p></p>
<p class="MsoPlainText"><a href="mailto:Openid-specs-ab@lists.openid.net"><span style="color:windowtext;text-decoration:none">Openid-specs-ab@lists.openid.net</span></a><o:p></o:p></p>
<p class="MsoPlainText"><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab"><span style="color:windowtext;text-decoration:none">http://lists.openid.net/mailman/listinfo/openid-specs-ab</span></a><o:p></o:p></p>
</div>
</body>
</html>