Re: [OAUTH-WG] draft 9, section 4.3.1 missing error code for invalid user credentials

2010-07-04 Thread Eran Hammer-Lahav
If the client credentials are bad the server returns: invalid-client-credentials If the end-user's credentials are bad, the server returns: invalid-grant Not sure what's the issue. EHL On 7/4/10 7:33 PM, "Andrew Arnott" wrote: Well, to the client app there's an important distinction I think.

Re: [OAUTH-WG] draft 9, section 4.3.1 missing error code for invalid user credentials

2010-07-04 Thread Andrew Arnott
Well, to the client app there's an important distinction I think. If the client id and secret are invalid, that signifies either an internal error or a total revocation of support for the client. But the username/password being bad means the client should ask the user to re-enter their credential