Subject: [OAUTH-WG] User Endpoint

From: Eran Hammer-Lahav <[email-masked]>
Date: Sun, 9 May 2010 14:15:47 -0700

I would like to rename the authorization endpoint to the user endpoint. Any objections?

EHL

---

From: "Manger, James H" <[email-masked]>
Date: Mon, 10 May 2010 10:31:28 +1000

> I would like to rename the authorization endpoint to the user endpoint. Any objections?

Sounds ok. An Authorization server offers token endpoints and user endpoints.

Can we change "resource owner" to "user" where applicable. Hence, a user get directed to a user endpoint.

Suggested new text for 3.1 "Authorization Endpoint":

"3.1 User endpoint

"A client app directs a user to a user endpoint at the authorization server to approve the client’s access.  The authorization server MUST authenticate the user and obtain their approval, though the way this is achieved is beyond the scope of this specification (eg password, OpenID, session cookie).

"A client app can obtain a user endpoint from a WWW-Authenticate HTTP response header returned by a resource server when it indicates that OAuth is required (see section 9.1.2). Some client apps may already know a user endpoint from server documentation.

"A user endpoint advertised by a resource server may already include query parameters, which MUST be retained when the client adds other query parameters.

"A user endpoint SHOULD be an HTTPS URI (or require a secure channel with equivalent protections) as interactions with a user endpoint involve user authentication and the transmission of sensitive values."

-- 
James Manger

---

From: Dick Hardt <[email-masked]>
Date: Sun, 9 May 2010 17:55:28 -0700

I prefer authorization endpoint as it talks about the functionality of what the client gets from that endpoint. Delegation endpoint is another alternative. User endpoint implies there must be a user present. I envision scenarios where an identity agent deals with the authorization for the user and the user is not involved. 

On 2010-05-09, at 2:15 PM, Eran Hammer-Lahav wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Sun, 9 May 2010 22:11:03 -0700

Both endpoints deal with authorization of sorts. The reason why we have two is one is for direct client-server communication and the other one involves the end-user (a human).

EHL

> -----Original Message-----
> From: Dick Hardt [mailto:[email-masked]]
> Sent: Sunday, May 09, 2010 5:55 PM
> To: Eran Hammer-Lahav
> Cc: OAuth WG ([email-masked])
> Subject: Re: [OAUTH-WG] User Endpoint
> 
> I prefer authorization endpoint as it talks about the functionality of what the
> client gets from that endpoint. Delegation endpoint is another alternative.
> User endpoint implies there must be a user present. I envision scenarios
> where an identity agent deals with the authorization for the user and the
> user is not involved.
>

---

From: "Richer, Justin P." <[email-masked]>
Date: Mon, 10 May 2010 08:18:56 -0400

So long as we keep some language in the text that this is the endpoint where the authorization by the user takes place, this change makes sense to me. People coming from OAuth 1 and similar schemes are going to be looking for the "authorization" part, I think.

 -- Justin

________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Eran Hammer-Lahav [[email-masked]]
Sent: Sunday, May 09, 2010 5:15 PM
To: OAuth WG ([email-masked])
Subject: [OAUTH-WG] User Endpoint

EHL

---

From: Evan Gilbert <[email-masked]>
Date: Mon, 10 May 2010 16:56:12 -0700

+1 on delegation.

This conveys the purpose nicely - I think these endpoints are always to
verify that there is a currently logged in user for the purpose of
delegation. "User" seems a bit vague - "user agent" seems more appropriate
if we want to reference that this occurs in a browser.

Also note that "token endpoint" is confusing given the fact that you can get
a token without ever talking to the token endpoint (in the User Agent flow).
Don't have great suggestions, but wanted to point out.

On Mon, May 10, 2010 at 5:18 AM, Richer, Justin P. <[email-masked]>wrote:

> So long as we keep some language in the text that this is the endpoint
> where the authorization by the user takes place, this change makes sense to
> me. People coming from OAuth 1 and similar schemes are going to be looking
> for the "authorization" part, I think.
>
>  -- Justin
>