<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Thank you, Justin!</div>
<div><br>
</div>
<div>My issue is that our customers expect our product to adhere to the spec. Therefore I cannot build in enforcements that are not specified.</div>
<div><br>
</div>
<div>I feel that the spec. gives big room for interpretation in the area.</div>
<div><br>
</div>
<div>If you or someone else would have references of typical implementations that would help.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Sascha</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Justin Richer <<a href="mailto:jricher@mit.edu">jricher@mit.edu</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, May 31, 2017 at 6:12 PM<br>
<span style="font-weight:bold">To: </span>Sascha Preibisch <<a href="mailto:sascha.preibisch@ca.com">sascha.preibisch@ca.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a> Ab" <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openid-specs-ab] Question on Dynamic Registration<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
The server needs to make sure that they’re consistent at the end of a successful registration. This could take the form of forcing the client to register a consistent set (response_type=code, grant_type=authorization_code) and returning an error otherwise.
Alternatively, the server could try to fill in the missing blanks for the client. Whatever the server decides is the result, it echoes back to the client, effectively dictating to the client the results of the registration.
<div class=""><br class="">
</div>
<div class="">If the server doesn’t support the requested grant type or response type, it should probably fail the registration request. If it doesn’t, it will just fail the authorization request later on.</div>
<div class=""><br class="">
</div>
<div class=""> — Justin</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On May 31, 2017, at 1:59 PM, Preibisch, Sascha H via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" class="">openid-specs-ab@lists.openid.net</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;" class="">
<div class="">Hi all!</div>
<div class=""><br class="">
</div>
<div class="">A team member and I just had a discussion about dynamic registration. Specifically about this section:</div>
<div class=""><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__openid.net_specs_openid-2Dconnect-2Dregistration-2D1-5F0.html-23ClientMetadata&d=DwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=7gpZwgA6J-66ZzRVOZ35WfAcDwwU5gYYOjWTTglaYWc&s=CPWlAukwMe2HJIcCAWQz82lNuoJJq8D-N0tSy-ylSHc&e=" class="">http://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata</a></div>
<div class=""><br class="">
</div>
<div class="">We are not sure how "response_types" and "grant_types" are expected to be handled. This is not clear to us:</div>
<ul class="">
<li class="">if a client registers for any other response_type than "code", is the client required to also include a "grant_type"?</li><li class="">Or is it that the server has to be configured to support the matching grant_type and fail otherwise?</li><li class="">Should the server return the matching grant_types although the spec. says to return "authorization_code" in the case of being omitted?</li></ul>
<div class="">It would be great to get some clarification on that.</div>
<div class=""><br class="">
</div>
<div class="">Thanks,</div>
<div class="">Sascha</div>
<div class=""><br class="">
</div>
</div>
_______________________________________________<br class="">
Openid-specs-ab mailing list<br class="">
<a href="mailto:Openid-specs-ab@lists.openid.net" class="">Openid-specs-ab@lists.openid.net</a><br class="">
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dab&d=DwQFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=7gpZwgA6J-66ZzRVOZ35WfAcDwwU5gYYOjWTTglaYWc&s=5Qki9nltVlv269MCWWgdyr3fZbd8_P8qJ-luz7bkkbE&e=">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br class="">
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</span>
</body>
</html>