Hi Justin, Thanks for your reply.
I had missed your proposal, but it’s indeed the same line-of-thought. My proposal is slightly different in the sense that the device_name (or: instance_name) would not originate from the client itself but from the ResourceOwner, e.g. during the authorisation process. This is probably specific or at least more relevant to devices with input constraints. I understand the point about dynamic client registration. At a first glance it seems very ‘open’, whereas in a lot of case you wouldn’t want any client to register. Moreover, I feel that using dynamic client registration just for the sake of setting up identifiers for a client instance seems a bit ‘heavy’. So I still feel it’s usefull to enhance the Device flow with something like: device_identifier / device_name / instance_name / instance_description regards, Jaap > Message: 2 > Date: Fri, 7 Jul 2017 07:54:13 -0400 > From: Justin Richer <[email protected]> > To: [email protected] > Subject: Re: [OAUTH-WG] Suggested enhancement of the OAuth Device Flow > Message-ID: <[email protected]> > Content-Type: text/plain; charset=utf-8; format=flowed > > I proposed this exact thing many years ago: > > https://tools.ietf.org/html/draft-richer-oauth-instance-00 > > At the time there wasn't very much interest in it, as people were > looking at using Dynamic Registration, with its attendant unique client > IDs, to solve that same problem. > > -- Justin _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
