<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
@font-face
{font-family:"MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Consolas","serif";}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">The problem with the Grant Type terminology for our purposes is that all the Response Type values that include “code” use the “authorization_code” “grant_type”
value, so it’s not useful for distinguishing between the different flows. We use the “flows” terminology to distinguish between and have names for the different ways that the different flows use the different endpoints. Having these names make some parts
of the spec significantly easier to read and understand.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I see the value in the table that Nat suggested. I’ll work to incorporate something like it in the introduction. Also, reviewers had asked us to restore the
table of supported Response Type values, so I plan to restore that and put it in the same introduction section.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> -- Mike<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">P.S. “Implicit Code Flow” was an editing error that was caught by several reviewers, and has already been fixed in
<a href="http://openid.bitbucket.org/openid-connect-core-1_0.html#Terminology">http://openid.bitbucket.org/openid-connect-core-1_0.html#Terminology</a>.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> openid-specs-ab-bounces@lists.openid.net [mailto:openid-specs-ab-bounces@lists.openid.net]
<b>On Behalf Of </b>John Bradley<br>
<b>Sent:</b> Wednesday, October 30, 2013 6:27 AM<br>
<b>To:</b> Nat Sakimura<br>
<b>Cc:</b> openid-specs-ab@lists.openid.net<br>
<b>Subject:</b> Re: [Openid-specs-ab] Guidance on what the different flows are for<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Right in RFC 6749 we moved to the term grant rather than flow but there are still some leftover mentions in the RFC. <o:p></o:p></p>
<div>
<p class="MsoNormal">So we have Code, refresh_token, client_credentials, and password grants along with implicit which has no grant_type parameter value.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">On Oct 30, 2013, at 8:47 AM, Nat Sakimura <<a href="mailto:sakimura@gmail.com">sakimura@gmail.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><br>
<br>
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><br>
Oct 30, 2013 20:04</span><span style="font-size:9.0pt;font-family:"MS Gothic"">、</span><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif"">John Bradley <<a href="mailto:ve7jtb@ve7jtb.com">ve7jtb@ve7jtb.com</a>>
</span><span style="font-size:9.0pt;font-family:"MS Gothic"">のメッセージ</span><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif"">:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif"">I like the table idea. <o:p></o:p></span></p>
</blockquote>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif"">Let's go that way. <o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif"">Where do you see "</span><span style="font-family:"Verdana","sans-serif";background:white">Implicit Code Flow"?</span><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><a href="http://openid.net/specs/openid-connect-core-1_0-14.html#Terminology">http://openid.net/specs/openid-connect-core-1_0-14.html#Terminology</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><o:p> </o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";background:white">RFC 6749 defines it. Essentially as any flow not using a grant type at the token endpoint, arguably more confusing than referring to the response types.</span><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><o:p></o:p></span></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif"">Yeah, actually, the paragraph 1 of 1.3.2 of RFC6749 starts as "The implicit grant is ... " then in the next sentence it says "In the implicit flow ... " so it sort of implicitly
defines implicit flow but not as a defined term . <o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><br>
<br>
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif"">On Oct 30, 2013, at 4:31 AM, n-sakimura <<a href="mailto:n-sakimura@nri.co.jp">n-sakimura@nri.co.jp</a>> wrote:<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><br>
<br>
<o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif";background:white">"Implicit Code Flow" is defined. Neither "Implicit Flow" nor "Code Flow" is defined.<span class="apple-converted-space"> </span><br>
And that is a very secondary point in my email.<span class="apple-converted-space"> </span><br>
What I pointed out was that perhaps a table is better as a guidance.<span class="apple-converted-space"> </span><br>
<br>
See my other email for the proposed text.<span class="apple-converted-space"> </span><br>
<br>
Nat<br>
</span><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><br>
<br>
(2013/10/30 15:42), Mike Jones wrote:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif"">"Implicit Flow" is defined in the Terminology section.<o:p></o:p></span></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif"">
<hr size="3" width="100%" align="center">
</span></div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif"">From:<span class="apple-converted-space"> </span>n-sakimura<br>
Sent:<span class="apple-converted-space"> </span>10/29/2013 9:51 PM<br>
To:<span class="apple-converted-space"> </span><a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a><br>
Subject:<span class="apple-converted-space"> </span>Re: [Openid-specs-ab] Guidance on what the different flows are for<o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif"">(2013/10/30 10:22), Mike Jones wrote:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Several reviewers have requested guidance on when to use the different flows. I believe that we’d be doing a service to our readers by providing it.<o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""> <o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Several reviewers have objected to this text in<span class="apple-converted-space"> </span><a href="http://openid.net/specs/openid-connect-core-1_0.html#Authentication">http://openid.net/specs/openid-connect-core-1_0.html#Authentication</a><span class="apple-converted-space"> </span>–
saying that sometimes the Code flow is used even when the client can’t maintain the secrecy of the client_secret:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN">The Authorization Code Flow is suitable for Clients that can securely maintain a Client Secret between themselves and the Authorization Server whereas, the Implicit
Flow is suitable for Clients that cannot.</span><o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""> <o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I believe that that the statement would still be true if we changed the word “suitable” to “intended”. And then, as discussed in the F2F meeting, we could add the sentence:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">“However, the Authorization Code flow is sometimes also used by Native applications in order to be able to obtain a Refresh Token, even when they cannot ensure the secrecy of the
client_secret value.”<o:p></o:p></p>
</div>
</blockquote>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif"">It does not have to be native applications.<span class="apple-converted-space"> </span><br>
We do not have to constrain code grant for anything.<span class="apple-converted-space"> </span><br>
<br>
Only the thing which may be worth noting is that (1) enables client authentication for confidential clients, (2) allows clients to obtain refresh token, (3) more secure than implicit grant as the token is not exposed in the front channel, (4) requires extra
roundtrip compaired to the implicit, (5) Token endpoint has to be directly reacheable from the client.<span class="apple-converted-space"> </span><br>
<br>
In contrast, the implicit grant will have (1) less roundtrip and thus latency, (2) the client does not need a direct reacheability to the server, (3) client cannot be confidential, (4) tokens are exposed in the frong channel so inherently less secure, and
(5) you cannot get refresh token with this grant.<span class="apple-converted-space"> </span><br>
<br>
Perhaps having tables like the following is better as the guidance.<span class="apple-converted-space"> </span><o:p></o:p></span></p>
<table class="MsoNormalTable" border="0" cellspacing="3" cellpadding="0">
<tbody>
<tr>
<td width="329" style="width:197.4pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Conditions / Requirement<o:p></o:p></p>
</td>
<td width="85" style="width:51.0pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">code grant<o:p></o:p></p>
</td>
<td width="85" style="width:51.0pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">implicit grant<o:p></o:p></p>
</td>
<td width="82" style="width:49.2pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">hybrid grant<o:p></o:p></p>
</td>
</tr>
<tr>
<td width="329" style="width:197.4pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Server is not directly reachable from the client<o:p></o:p></p>
</td>
<td width="85" style="width:51.0pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal"> <o:p></o:p></p>
</td>
<td width="85" style="width:51.0pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">x<o:p></o:p></p>
</td>
<td width="82" style="width:49.2pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal"> <o:p></o:p></p>
</td>
</tr>
<tr>
<td width="329" style="width:197.4pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Want less round trip<o:p></o:p></p>
</td>
<td width="85" style="width:51.0pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal"> <o:p></o:p></p>
</td>
<td width="85" style="width:51.0pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">x<o:p></o:p></p>
</td>
<td width="82" style="width:49.2pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">x<o:p></o:p></p>
</td>
</tr>
<tr>
<td width="329" style="width:197.4pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Do not want to reveal tokens for better security<o:p></o:p></p>
</td>
<td width="85" style="width:51.0pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">x<o:p></o:p></p>
</td>
<td width="85" style="width:51.0pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal"> <o:p></o:p></p>
</td>
<td width="82" style="width:49.2pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">(some)<o:p></o:p></p>
</td>
</tr>
<tr>
<td width="329" style="width:197.4pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Want client authentication<o:p></o:p></p>
</td>
<td width="85" style="width:51.0pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">x<o:p></o:p></p>
</td>
<td width="85" style="width:51.0pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal"> <o:p></o:p></p>
</td>
<td width="82" style="width:49.2pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">x<o:p></o:p></p>
</td>
</tr>
<tr>
<td width="329" style="width:197.4pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Want refresh token<o:p></o:p></p>
</td>
<td width="85" style="width:51.0pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">x<o:p></o:p></p>
</td>
<td width="85" style="width:51.0pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal"> <o:p></o:p></p>
</td>
<td width="82" style="width:49.2pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">x<o:p></o:p></p>
</td>
</tr>
<tr>
<td width="329" style="width:197.4pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Slow front channel, fast back channel<o:p></o:p></p>
</td>
<td width="85" style="width:51.0pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">x<o:p></o:p></p>
</td>
<td width="85" style="width:51.0pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal"> <o:p></o:p></p>
</td>
<td width="82" style="width:49.2pt;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">x<o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><br>
The same table is uploaded here:<span class="apple-converted-space"> </span><a href="http://nat.sakimura.org/2013/10/30/guidance-on-which-grant-flow-to-use-for-openid-connect/">http://nat.sakimura.org/2013/10/30/guidance-on-which-grant-flow-to-use-for-openid-connect/</a><br>
<br>
BTW, do we still want to use the term "flow"? OAuth stopped using the term and it uses "grant" instead. Currently, "implicit flow" for example is not defined.<span class="apple-converted-space"> </span><br>
<br>
Nat<br>
<br>
<br>
<br>
<o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""> <o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Would that combination work for people?<o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""> <o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Finally, I propose that we add this guidance about the Hybrid Flow:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">“The Hybrid flow enables Clients to obtain an ID Token and/or Access Token with only one round trip to the Authorization Server, possibly minimizing latency, while still enabling
Clients to later get tokens from the Token Endpoint – especially a Refresh Token.”<o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""> <o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Per the decision at the F2F, all this “guidance” text would move to the introduction.<o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""> <o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Are people good with the wording above, or would you like to make alternative suggestions?<o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""> <o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <span class="apple-converted-space"> </span>-- Mike<o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""> <o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><br>
<br>
<o:p></o:p></span></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>Openid-specs-ab mailing list<o:p></o:p></pre>
<pre><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><o:p></o:p></pre>
<pre><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><o:p></o:p></pre>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><br>
<br>
<br>
<o:p></o:p></span></p>
<pre>-- <o:p></o:p></pre>
<pre>Nat Sakimura (<a href="mailto:n-sakimura@nri.co.jp">n-sakimura@nri.co.jp</a>)<o:p></o:p></pre>
<pre>Nomura Research Institute, Ltd. <o:p></o:p></pre>
<pre><a href="tel:+81-3-6274-1412">Tel:+81-3-6274-1412</a> Fax:+81-3-6274-1547<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><span style="font-family:"MS Gothic"">本メールに含まれる情報は機密情報であり、宛先に記載されている方のみに送信することを意図しております。意図された受取人以外の方によるこれらの情報の開示、複製、再配布や転送など一切の利用が禁止されています。誤って本メールを受信された場合は、申し訳ござ</span>ӓ<o:p></o:p></pre>
<pre> 6;|<o:p></o:p></pre>
<pre>14;<span style="font-family:"MS Gothic"">せんが、送信者までお知らせいただき、受信されたメールを削除していただきますようお願い致します。</span><o:p></o:p></pre>
<pre>PLEASE READ:<o:p></o:p></pre>
<pre>The information contained in this e-mail is confidential and intended for the named recipient(s) only.<o:p></o:p></pre>
<pre>If you are not an intended recipient of this e-mail, you are hereby notified that any review, dissemination, distribution or duplication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately and delete your copy from your system.<o:p></o:p></pre>
</div>
</blockquote>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><br>
<br>
<br>
<o:p></o:p></span></p>
<pre>-- <o:p></o:p></pre>
<pre>Nat Sakimura (<a href="mailto:n-sakimura@nri.co.jp">n-sakimura@nri.co.jp</a>)<o:p></o:p></pre>
<pre>Nomura Research Institute, Ltd. <o:p></o:p></pre>
<pre><a href="tel:+81-3-6274-1412">Tel:+81-3-6274-1412</a> Fax:+81-3-6274-1547<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><span style="font-family:"MS Gothic"">本メールに含まれる情報は機密情報であり、宛先に記載されている方のみに送信することを意図しております。意図された受取人以外の方によるこれらの情報の開示、複製、再配布や転送など一切の利用が禁止されています。誤って本メールを受信された場合は、申し訳ございませんが、送信者までお知らせいただき、受信されたメールを削除していただきますようお願い致します。</span><o:p></o:p></pre>
<pre>PLEASE READ:<o:p></o:p></pre>
<pre>The information contained in this e-mail is confidential and intended for the named recipient(s) only.<o:p></o:p></pre>
<pre>If you are not an intended recipient of this e-mail, you are hereby notified that any review, dissemination, distribution or duplication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately and delete your copy from your system.<o:p></o:p></pre>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif"">_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif""><o:p> </o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif"">_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><o:p></o:p></span></p>
</blockquote>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>