Re: [OAUTH-WG] Mail regarding draft-ietf-oauth-dyn-reg

2013-01-13 Thread Torsten Lodderstedt
Hi Keith, comment see below. Am 10.01.2013 um 22:54 schrieb "Boone, Keith W (GE Healthcare)" : > > > Imagine the case where I purchase an application and download it to my iPhone > and to my iPad. Then I connect that application to a data holder/authorizer > combination it hasn't seen bef

Re: [OAUTH-WG] Mail regarding draft-ietf-oauth-dyn-reg

2013-01-11 Thread Richer, Justin P.
Thanks for the thorough writeup, this is definitely an interesting use case. There are a few ways that you could go about this, from what I'm seeing, but there are also some things to untangle first. My apologies for the wall of text. First, public clients can keep secrets, but there's a differe

Re: [OAUTH-WG] Mail regarding draft-ietf-oauth-dyn-reg

2013-01-11 Thread Boone, Keith W (GE Healthcare)
The challenge is that we project an environment where there could be thousands of applications conforming to a particular API (see http://wiki.siframework.org/ABBI+Pull+Workgroup), with thousands of data holders making data available through those APIs, and several authorizers (in the OAuth 2.0

Re: [OAUTH-WG] Mail regarding draft-ietf-oauth-dyn-reg

2013-01-10 Thread Richer, Justin P.
Interesting use case, and not dissimilar to some others I've heard. How would you go about tracking this? Why would the instances need to know about each other? One possible approach would be to use a common initializing Request Access Token that is used to call client_register on all instances