It is true that the grant_type is a client side consideration. I did think about the "client_id==sub" heuristic, but that's not always applicable: many systems have their own rules for generating sub, and in case they want to prevent tracking across RSes the sub might be generated ad-hoc for that particular RS. Would you prefer to have a dedicated claim that distinguish between user and app tokens rather than reusing grant_type?
On Mon, May 6, 2019 at 12:16 PM Vladimir Dzhuvinov <vladi...@connect2id.com> wrote: > On 06/05/2019 20:32, Vittorio Bertocci wrote: > > To that end, *Karl MCGuinness suggested that we include > > grant_type as a return claim, which the RS could use to the same > effect*. I > > find the proposal very clever, and the people at IIW thought so as well. > > What you think? > > The grant type is not something that the RS is really concerned with, or > should be. Introducing this parameter in the access token will create an > additional logical dependency, plus complexity - in the system of > client, AS and RS as a whole, as well as for RS developers. The grant > type, as a concept, is a matter between the client and AS, and IMO > should stay that way. > > Clear language in the spec should suffice. For instance: "If the sub > value matches the client_id value, then the subject is the client > application". > > Vladimir > > -- > Vladimir Dzhuvinov > > > _______________________________________________ > OAuth mailing list > OAuth@ietf.org > https://www.ietf.org/mailman/listinfo/oauth >
_______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
