Sorry, I've been otherwise occupied recently with non connect related work. I'll try and engage Breno and Naveen on this today.<br><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Dec 3, 2012 at 3:59 PM, Mike Jones <span dir="ltr"><<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p><b><span style="color:red">Brian</span></b>, last week the working group made this request of you to drive a discussion on this issue:<u></u><u></u></p>
<p><u></u> <u></u></p>
<p style="margin-left:.5in">It is this way because currently Google always requires the redirect_uri value.
<b><span style="color:red">Brian</span></b>, could you start a thread on the list with Breno and Naveen asking if they'd be OK with relaxing the spec to allow the redirect_uri parameter not to be present when only one redirect_uri is registered?<u></u><u></u></p>
<div class="im">
<p><u></u><u></u></p>
<p style="margin-left:.5in">Similarly, for the same reasons, we currently require sending the redirect_uri to the token endpoint even in cases where OAuth doesn't require it because we already have a single registered redirect_uri. We should
probably discuss this at the same time.<u></u><u></u></p>
<p><u></u> <u></u></p>
</div><p>Could you try to get that going this week? We’d like to decide soon whether any changes will be made in response to this issue.<u></u><u></u></p>
<p><u></u> <u></u></p>
<p> Thanks,<u></u><u></u></p>
<p> -- Mike<u></u><u></u></p><div class="im">
<p><u></u> <u></u></p>
<p>-----Original Message-----<br>
From: <a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a> [mailto:<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>] On Behalf Of Brian Campbell<br>
Sent: Friday, October 19, 2012 2:13 PM<br>
To: <a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a><br>
Subject: [Openid-specs-ab] [openid/connect] Inconsistent treatment of redirect_uri parameter (issue #669)</p>
<p><u></u> <u></u></p>
<p>--- you can reply above this line ---<u></u><u></u></p>
<p><u></u> <u></u></p>
</div><p>New issue 669: Inconsistent treatment of redirect_uri parameter
<a href="https://bitbucket.org/openid/connect/issue/669/inconsistent-treatment-of-redirect_uri" target="_blank">
<span style="color:windowtext;text-decoration:none">https://bitbucket.org/openid/connect/issue/669/inconsistent-treatment-of-redirect_uri</span></a><u></u><u></u></p>
<p><u></u> <u></u></p>
<p>Brian Campbell:<u></u><u></u></p><div class="im">
<p><u></u> <u></u></p>
<p>OAuth 2.0 (RFC 6749!) defines redirect_uri as an optional parameter in an authorization request in cases where the client has a single unambiguous redirect_uri registered with the AS and then only requires it in an access token request
when it had previously been included in the corresponding authorization request [1].<u></u><u></u></p>
<p><u></u> <u></u></p>
<p>The treatment of redirect_uri in the Connect specs isn't always consistent with OAuth, however, and is also somewhat internally inconsistent though different Connect specs.<u></u><u></u></p>
<p><u></u> <u></u></p>
<p>Standard has redirect_uri required in the authorization request [2] while allowing it to be omitted in the token request [3]. Messages has it required [4] as does Basic [5] and Implicit [6]. The wording in Registration seem to suggest
that it's required [7].<u></u><u></u></p>
<p><u></u> <u></u></p>
<p>I'd argue that Connect should be consistent with the OAuth for redirect_uri treatment. It should be optional/required under the same conditions as in OAuth (unless there is some compelling reason to differ). It might make sense to just
defer directly to OAuth for the core parameter definitions and only define in Connect additional parameters or those that do need to be treated differently.
<u></u><u></u></p>
<p><u></u> <u></u></p>
<p><u></u> <u></u></p>
<p>[1] <a href="http://tools.ietf.org/html/rfc6749#section-3.1.2.3" target="_blank">
<span style="color:windowtext;text-decoration:none">http://tools.ietf.org/html/rfc6749#section-3.1.2.3</span></a><u></u><u></u></p>
<p><a href="http://tools.ietf.org/html/rfc6749#section-4.1.1" target="_blank"><span style="color:windowtext;text-decoration:none">http://tools.ietf.org/html/rfc6749#section-4.1.1</span></a><u></u><u></u></p>
<p><a href="http://tools.ietf.org/html/rfc6749#section-4.1.3" target="_blank"><span style="color:windowtext;text-decoration:none">http://tools.ietf.org/html/rfc6749#section-4.1.3</span></a><u></u><u></u></p>
<p><a href="http://tools.ietf.org/html/rfc6749#section-4.2.1" target="_blank"><span style="color:windowtext;text-decoration:none">http://tools.ietf.org/html/rfc6749#section-4.2.1</span></a><u></u><u></u></p>
<p><u></u> <u></u></p>
<p>[2] <a href="http://openid.net/specs/openid-connect-standard-1_0.html#rf_prep" target="_blank">
<span style="color:windowtext;text-decoration:none">http://openid.net/specs/openid-connect-standard-1_0.html#rf_prep</span></a><u></u><u></u></p>
<p>[3] <a href="http://openid.net/specs/openid-connect-standard-1_0.html#anchor9" target="_blank">
<span style="color:windowtext;text-decoration:none">http://openid.net/specs/openid-connect-standard-1_0.html#anchor9</span></a><u></u><u></u></p>
<p>[4] <a href="http://openid.net/specs/openid-connect-messages-1_0.html#auth_req" target="_blank">
<span style="color:windowtext;text-decoration:none">http://openid.net/specs/openid-connect-messages-1_0.html#auth_req</span></a><u></u><u></u></p>
<p>[5] <a href="http://openid.net/specs/openid-connect-basic-1_0.html#rf_prep" target="_blank">
<span style="color:windowtext;text-decoration:none">http://openid.net/specs/openid-connect-basic-1_0.html#rf_prep</span></a><u></u><u></u></p>
<p>[6] <a href="http://openid.net/specs/openid-connect-implicit-1_0.html#rf_prep" target="_blank">
<span style="color:windowtext;text-decoration:none">http://openid.net/specs/openid-connect-implicit-1_0.html#rf_prep</span></a><u></u><u></u></p>
<p>[7] <a href="http://openid.net/specs/openid-connect-registration-1_0.html#anchor3" target="_blank">
<span style="color:windowtext;text-decoration:none">http://openid.net/specs/openid-connect-registration-1_0.html#anchor3</span></a><u></u><u></u></p>
<p><u></u> <u></u></p>
<p><u></u> <u></u></p>
<p><u></u> <u></u></p>
<p><u></u> <u></u></p>
<p><u></u> <u></u></p>
</div><p>--<u></u><u></u></p><div class="im">
<p><u></u> <u></u></p>
<p>This is an issue notification from <a href="http://bitbucket.org" target="_blank">bitbucket.org</a>. You are receiving this either because you are the owner of the issue, or you are following the issue.<u></u><u></u></p>
</div><p>_______________________________________________<u></u><u></u></p>
<p>Openid-specs-ab mailing list<u></u><u></u></p>
<p><a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank"><span style="color:windowtext;text-decoration:none">Openid-specs-ab@lists.openid.net</span></a><u></u><u></u></p>
<p><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank"><span style="color:windowtext;text-decoration:none">http://lists.openid.net/mailman/listinfo/openid-specs-ab</span></a><u></u><u></u></p>
</div>
</div>
</blockquote></div><br></div>