<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">I’ve created <a href="http://hg.openid.net/connect/issue/725/implicit-tony-nadalins-review-comments">
http://hg.openid.net/connect/issue/725/implicit-tony-nadalins-review-comments</a> to track these review comments.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> -- Mike<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> openid-specs-ab-bounces@lists.openid.net [mailto:openid-specs-ab-bounces@lists.openid.net]
<b>On Behalf Of </b>Anthony Nadalin<br>
<b>Sent:</b> Friday, January 25, 2013 10:22 AM<br>
<b>To:</b> openid-specs-ab@lists.openid.net<br>
<b>Subject:</b> [Openid-specs-ab] openid-connect-implicit-1_0-06 review<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Section 2.2.1<o:p></o:p></p>
<p class="MsoListParagraph" style="margin-left:.75in;text-indent:-.25in">1.<span style="font-size:7.0pt;font-family:"Times New Roman","serif"">
</span>Not sure what RFC the Authorization Endpoint should use for HTTPS ? RFC 2818? If so should also be listed.<o:p></o:p></p>
<p class="MsoListParagraph" style="margin-left:.75in;text-indent:-.25in">2.<span style="font-size:7.0pt;font-family:"Times New Roman","serif"">
</span>Response_type there is nothing in the core that indicates that there might be more that a single value here since it’s just response_type, seems overloaded to me<o:p></o:p></p>
<p class="MsoNormal">Section 2.2.3<o:p></o:p></p>
<p class="MsoListParagraph" style="text-indent:-.25in">1.<span style="font-size:7.0pt;font-family:"Times New Roman","serif"">
</span>Should state that TLS needs to be used and point the reader to section 2.3 in RFC6749<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Section 2.2.4 <o:p></o:p></p>
<p class="MsoNormal"> 1. Seems odd to have this in an implicit flow since in an implicit flow the end-user is not authenticated<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Section 2.2.5.1<o:p></o:p></p>
<p class="MsoNormal"> 1. expires_in – how do you know what this is relative to?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Section 2.3<o:p></o:p></p>
<p class="MsoNormal"> 1. “the following claims are required” but then some optional ones are listed, so the heading is wrong<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Section 2.3.1 & 2.3.2<o:p></o:p></p>
<p class="MsoNormal"> 1. Validation does not say what to do if there is a failure<o:p></o:p></p>
<p class="MsoNormal"> 2. Why can’t one use ES256?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Section 2.4<o:p></o:p></p>
<p class="MsoNormal"> 1. This seems to be in opposition to section 1.6 in RFC6749<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Section 2.4.2<o:p></o:p></p>
<p class="MsoNormal"> 1. Does not say how the response is to be returned, secure or not? Are all the members returned and ones that don’t have values are null? Or is it assumed if they are not returned they are null?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>