Subject: Re: [oauth-ext-review] Proposal for a small extension to facilitate token management

From: Breno de Medeiros <[email-masked]>
Date: Wed, 13 May 2020 14:20:30 -0700

Any feedback?

On Fri, Apr 17, 2020 at 12:05 PM Breno de Medeiros <[email-masked]> wrote:

> In some situations we have encountered requests from clients to have more
> metadata associated with tokens to facilitate human comprehension and
> management.
>
> I would like to suggest the following extension parameters for IANA
> registration, respectively an additional optional request and response
> parameter in the OAuth2 token endpoint:
>
> token_description: Value is a quote-delimited, case-sensitive string
> including spaces. This is supposed to be a human-readable description of
> the token.
>
> And a matched response parameter:
>
> token_id: Value is base64 url-safe value representing a service-generated
> id.
>
> ASes that support token_description and/or token_id MAY return these as
> part of token introspection endpoint responses or MAY display these to end
> users if they provide a token management interface. Otherwise it is out of
> scope for the specification where token_description or token_id is made
> visible or available.
>
> ASes that support these parameters SHOULD publish for which grant types in
> the token endpoint they support these parameters.
>
> Waiting on your feedback,
>
> --
>
> --Breno
>

-- 

--Breno

---

From: Mike Jones <[email-masked]>
Date: Wed, 13 May 2020 21:27:13 +0000

I’d replied with this question on the day of your original request:
              Is there a public URL for the specification defining these parameters?  That is a required part of the registration request.

                                                          -- Mike

From: oauth-ext-review <[email-masked]> On Behalf Of Breno de Medeiros
Sent: Wednesday, May 13, 2020 2:21 PM
To: [email-masked]
Subject: Re: [oauth-ext-review] Proposal for a small extension to facilitate token management

Any feedback?

On Fri, Apr 17, 2020 at 12:05 PM Breno de Medeiros <[email-masked]<mailto:[email-masked]>> wrote:
In some situations we have encountered requests from clients to have more metadata associated with tokens to facilitate human comprehension and management.

I would like to suggest the following extension parameters for IANA registration, respectively an additional optional request and response parameter in the OAuth2 token endpoint:

token_description: Value is a quote-delimited, case-sensitive string including spaces. This is supposed to be a human-readable description of the token.

token_id: Value is base64 url-safe value representing a service-generated id.

ASes that support token_description and/or token_id MAY return these as part of token introspection endpoint responses or MAY display these to end users if they provide a token management interface. Otherwise it is out of scope for the specification where token_description or token_id is made visible or available.

ASes that support these parameters SHOULD publish for which grant types in the token endpoint they support these parameters.

--

--Breno

--

--Breno