<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Thanks Justin!</div>
<div><br>
</div>
<div>I guess it comes down to a single IdP to implement it the way he wants to enable users to be in control. It seems to be difficult to get a general consent on this topic.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Sascha</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Justin Richer <<a href="mailto:jricher@mit.edu">jricher@mit.edu</a>><br>
<span style="font-weight:bold">Date: </span>Monday, August 17, 2015 at 10:01 AM<br>
<span style="font-weight:bold">To: </span>Sascha Preibisch <<a href="mailto:sascha.preibisch@ca.com">sascha.preibisch@ca.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a> Ab" <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openid-specs-ab] SCOPE not selectable<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
The optionality and deselection of scopes is the purview of the IdP and its security policies. Some implementations of OIDC allow the user to deselect scopes (MITREid Connect, which I work on, does for instance) while others only allow for an overall yes/no
approval (Google is like this, for instance).
<div class=""><br class="">
</div>
<div class="">The previous version of OpenID tried to have “optional’ and “required” information sets with SREG and AX, but in both of these cases, RP’s just sent everything as “required”. The optionality was completely ignored in practice, and I suspect it
would be again.</div>
<div class=""><br class="">
</div>
<div class="">In OAuth and OIDC, if the client doesn’t get the scopes it wants, it can ask again until the user gives up trying to make it work.</div>
<div class="">
<div class=""><br class="">
</div>
<div class=""> — Justin</div>
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Aug 17, 2015, at 12:34 PM, Preibisch, Sascha H <<a href="mailto:Sascha.Preibisch@ca.com" class="">Sascha.Preibisch@ca.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;" class="">
<div class="">Hi!</div>
<span id="OLK_SRC_BODY_SECTION" class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;" class="">
<div class=""><br class="">
</div>
<div class="">It may be an old topic but on the weekend I got a new Android phone and I attempted to install the LinkedIn and Twitter apps. Both apps requested about 10 permissions. Which I denied and therefore not installed.</div>
<div class=""><br class="">
</div>
<div class="">I may be the only one who is annoyed by that but what is the reason why there is no effort in creating “optional” permissions? In the earlier development phase of OpenID Connect I joined a working group call and showed an example of an authorization
page that required SCOPE “openid” but others were de-selectable by the resource owner. The others on that call did not appreciate that idea.</div>
<div class=""><br class="">
</div>
<div class="">At IIW in March/ April 2014 Justin also mentioned the problem (what to do if requested SCOPE=LIVE KILL) but I do not see anyone addressing that or trying to change it.</div>
<div class=""><br class="">
</div>
<div class="">Thanks for any thoughts on that,</div>
<div class="">Sascha</div>
</div>
</span></div>
_______________________________________________<br class="">
Openid-specs-ab mailing list<br class="">
<a href="mailto:Openid-specs-ab@lists.openid.net" class="">Openid-specs-ab@lists.openid.net</a><br class="">
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br class="">
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</div>
</span>
</body>
</html>