The following errata report has been submitted for RFC8414, "OAuth 2.0 Authorization Server Metadata"
-------------------------------------- You may review the report below and at: https://errata.rfc-editor.org/eid9178/ -------------------------------------- Type: Technical Reported by: Wren Turkal <[email protected]> Section 3.1 and 3.2 says: Original Text ------------- In the first example of Section 3.1, "https://example.com"; is the issuer. Section 3.2 has an example response that identifies the issuer as "https://server.example.com";. Corrected Text -------------- Section 3.2 should update the issuer for the example response to be "https://example.com"; Notes ----- If I am understanding how the issuer is used to generate the well-known URL for the discovery document, it seems that the issuer in the response example in Section 3.2 should be "https://example.com"; to match one of the examples in 3.1. Section 6.2 also confirms that prefix for the URL for the metadata request and the issuer field in the discovery document must match exactly. Making the examples align with that would make it easier to understand. I have seen many issuers in the wild that do not match the issuer derived from the discovery document URL, so it seems that this part of the standard is commonly violated. For example, of Google, Microsoft, and Quickbooks Online OAuth implementations, only the Google's implementation complies with the Section 6.2 guidance of matching issuer URL prefix and issuer field in the discovery doc. Instructions: ------------- This erratum is currently posted as "Reported". Please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party will log in to change the status and edit the report, if necessary. -------------------------------------- RFC8414 (draft-ietf-oauth-discovery) -------------------------------------- Title : OAuth 2.0 Authorization Server Metadata Publication Date : June 2018 Author(s) : M. Jones, N. Sakimura, J. Bradley Category : Proposed Standard Source : oauth (sec) Stream : IETF Verifying Party : IESG _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
