<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">In the case of the appinfo endpoint it is controlled by the same entity as the AS. OAuth doesn't restrict the token format, I don't know that we should.<div><br></div><div>What interoperability issue do you see. I can see an argument for standardizing the access tokens when they are issued for external resources. </div><div>On the other hand using the assertion flow gets around that to some extent.</div><div>be sent </div><div>The reason that it is GET or POST is that some clients may not be able to place the token in a header to safely use GET, OAuth allows the AT to the Protected resource in a POST body as an option.</div><div><br></div><div>John B.</div><div><br><div><div>On Sep 29, 2014, at 8:01 PM, Emily Xu <<a href="mailto:exu@vmware.com">exu@vmware.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;">
<div>Thanks for your reply John. For question number 1, I hope we can define some standard claims in access token for better interoperability. </div>
<div><br>
</div>
<div>Another question: Section 7.2 says "To obtain application metadata information, the
<em>TA</em> MAY make a GET or POST request to the AppInfo Endpoint.". Any reason we add POST request there?</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Emily</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family: Calibri; font-size: 11pt; text-align: left; border-width: 1pt medium medium; border-style: solid none none; padding: 3pt 0in 0in; border-top-color: rgb(181, 196, 223);">
<span style="font-weight:bold">From: </span>John Bradley <<a href="mailto:ve7jtb@ve7jtb.com">ve7jtb@ve7jtb.com</a>><br>
<span style="font-weight:bold">Date: </span>Monday, September 29, 2014 12:03 PM<br>
<span style="font-weight:bold">To: </span>Emily Xu <<a href="mailto:exu@vmware.com">exu@vmware.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:openid-specs-native-apps@lists.openid.net">openid-specs-native-apps@lists.openid.net</a>" <<a href="mailto:openid-specs-native-apps@lists.openid.net">openid-specs-native-apps@lists.openid.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openid-specs-native-apps] AppInfo endpoint<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
Inline<br>
<div>
<div>On Sep 29, 2014, at 1:23 PM, Emily Xu <<a href="mailto:exu@vmware.com">exu@vmware.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;">
<div>I have a couple of questions related to NAPPS AppInfo endpoint.</div>
<div><br>
</div>
<div>1. In Section 7.2.1, it says "Access Token obtained from an OpenID Connect Authorization Request". I assume it means the access_token should contain "openid" in scope. Is it correct?</div>
</div>
</blockquote>
<div><br>
</div>
The format of access tokens issued by the Authorization endpoint for the AppInfo endpoint is unspecified, as the AppInfo endpoint and the AS are tightly related and the tokens are opaque to the client.</div>
<div><br>
</div>
<div>The Authorization request MUST have "openid" in the scopes requested. It is however up to the AS to decide if that needs to be indicated in the access token.</div>
<div><br>
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;">
<div><br>
</div>
<div>2. In Section 7.2.2, it says</div>
<div> "apps</div>
<div>REQUIRED (Array). One or more JSON objects containing claims about applications that the
<em>TA</em> can provide tokens or web boot-stap uri for."</div>
</div>
</blockquote>
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;">
<div><br>
</div>
<div>Any reason it must be "One or more" instead of "Zero or more"? If there is zero app authorized for this particular user, what the response should be?</div>
</div>
</blockquote>
<div><br>
</div>
OK Good point if there are no apps then it would be an empty array. I suspect that was a hold over from the TA validating the bundleid directly as the TA woulden't have had much to do with zero apps.</div>
<div><br>
</div>
<div>I will make that change.</div>
<div><br>
</div>
<div>John B.<br>
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;">
<div><span style="text-align: left; "><br>
</span></div>
<div><span style="text-align: left; ">Thanks,</span></div>
<div><span style="text-align: left; ">Emily</span></div>
</div>
_______________________________________________<br>
Openid-specs-native-apps mailing list<br>
<a href="mailto:Openid-specs-native-apps@lists.openid.net">Openid-specs-native-apps@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-native-apps">http://lists.openid.net/mailman/listinfo/openid-specs-native-apps</a><br>
</blockquote>
</div>
<br>
</div>
</div>
</span>
</div>
</blockquote></div><br></div></body></html>