<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">The optionality and deselection of scopes is the purview of the IdP and its security policies. Some implementations of OIDC allow the user to deselect scopes (MITREid Connect, which I work on, does for instance) while others only allow for an overall yes/no approval (Google is like this, for instance). <div class=""><br class=""></div><div class="">The previous version of OpenID tried to have “optional’ and “required” information sets with SREG and AX, but in both of these cases, RP’s just sent everything as “required”. The optionality was completely ignored in practice, and I suspect it would be again.</div><div class=""><br class=""></div><div class="">In OAuth and OIDC, if the client doesn’t get the scopes it wants, it can ask again until the user gives up trying to make it work.</div><div class=""><div class=""><br class=""></div><div class=""> — Justin</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Aug 17, 2015, at 12:34 PM, Preibisch, Sascha H <<a href="mailto:Sascha.Preibisch@ca.com" class="">Sascha.Preibisch@ca.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;" class="">
<div class="">Hi!</div>
<span id="OLK_SRC_BODY_SECTION" class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;" class="">
<div class=""><br class="">
</div>
<div class="">It may be an old topic but on the weekend I got a new Android phone and I attempted to install the LinkedIn and Twitter apps. Both apps requested about 10 permissions. Which I denied and therefore not installed.</div>
<div class=""><br class="">
</div>
<div class="">I may be the only one who is annoyed by that but what is the reason why there is no effort in creating “optional” permissions? In the earlier development phase of OpenID Connect I joined a working group call and showed an example of an authorization page
that required SCOPE “openid” but others were de-selectable by the resource owner. The others on that call did not appreciate that idea.</div>
<div class=""><br class="">
</div>
<div class="">At IIW in March/ April 2014 Justin also mentioned the problem (what to do if requested SCOPE=LIVE KILL) but I do not see anyone addressing that or trying to change it.</div>
<div class=""><br class="">
</div>
<div class="">Thanks for any thoughts on that,</div>
<div class="">Sascha</div>
</div>
</span>
</div>
_______________________________________________<br class="">Openid-specs-ab mailing list<br class=""><a href="mailto:Openid-specs-ab@lists.openid.net" class="">Openid-specs-ab@lists.openid.net</a><br class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab<br class=""></div></blockquote></div><br class=""></div></div></body></html>