Thanks!
On Thu, Apr 22, 2010 at 4:49 PM, Brian Eaton <bea...@google.com> wrote: > > So I’d propose changing the profile as follows: > > - Client requests device code by sending type=device and client_id=<id> > I might be reading something different than you are, but according to http://tools.ietf.org/html/draft-hammer-oauth2-00#section-3.5.3.1 those are the parameters included. > - Authorization server doesn’t return approval URL - device hard-codes > this instead. > I expect that this will point to a manufacturer specific page, and > that the manufacturer specific page will automatically redirect to a > page on the authorization server. > By having the Authorization Server pass the Client the approval URL it's much easier to change over the lifetime of a living room device. This could be in your application settings (for Facebook's usage) if it's pointing to a page on the manufacturer's site. Or it gives the Authorization Server the ability to change it if they're hosting the page. > - Approval URL MUST have client_id, and MAY have callback. > I expect that the client_id will be used to brand the approval > page, and that the callback will point to a manufacturer specific > completion page. > I don't fully understand what you're proposing. The device would show a screen which tells the user to visit http://fb.me/xbox and enter the code 123456. (Or to visit http://xbox.com/fb.) Asking a user to go to http://goo.gl/?client_id=bndi12boi1 seems like it's prone to user error. Plus a few comments on error codes: > > “End User Authorization Pending or Expired” - authorization server > probably isn’t going to be able to tell whether a code has expired, or > was never issued. Probably just return “unknown_code”. > > The “slow_down” error probably merits an “interval”. Maybe always > return “interval” with authorization_pending, and eliminate the > slow_down error code entirely? > > Cheers, > Brian > > [1] http://sites.google.com/site/oauthgoog/UXFedLogin/desktopapps > [2] http://sites.google.com/site/oauthgoog/UXFedLogin/nobrowser > _______________________________________________ > OAuth mailing list > OAuth@ietf.org > https://www.ietf.org/mailman/listinfo/oauth >
_______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
