OAuth 2.0 - IANA Considerations

OAuth Access Token Types Registry

OAuth access tokens are registered by experts with required specification. If they are satisfied with the registration, only then they will publish the specification. The registration request will be sent to the @ietf.org for reviewing with the subject ("Request for access token type: example"). Experts will either reject or accept the request within 14 days of the request.

Registration Template

The registration template contains the following specifications −

Type Name − It is the name of the request.
Token Endpoint Response Parameters − The additional access token response parameter will be registered separately in OAuth parameters registry.
HTTP Authentication Scheme − The HTTP authentication scheme can be used to authenticate the resources by using the access token.
Change Controller − Give the state name as "IETF" for standard track RFCs, and for others, use the name of the responsible party.
Specification Document − The specification document contains the parameter that can be used to retrieve a copy of the document.

OAuth Parameters Registry

OAuth parameters registry contains registration of authorization endpoint request or response, token endpoint request or response by the experts with the required specification. The registration request will be sent to the experts and if they are satisfied with registration, then they will publish the specification.

Registration Template

The registration template contains specifications such as Type Name, Change Controller and Specification Document as defined in the above OAuth Access Token Types Registry section, except the following specification −

Parameter Usage Location − It specifies the location of the parameter such as authorization request or response, token request or response.

Initial Registry Contents

The following table shows OAuth parameters registry containing the initial contents −

Sr.No.	Parameter Name & Usage Location	Change Controller	Specification Document
1	client_id authorization request, token request	IETF	RFC 6749
2	client_secret token request	IETF	RFC 6749
3	response_type authorization_request	IETF	RFC 6749
4	redirect_uri authorization request, authorization	IETF	RFC 6749
5	scope authorization request or response, token request or response	IETF	RFC 6749
6	state authorization request or response	IETF	RFC 6749
7	code token request, authorization response	IETF	RFC 6749
8	error_description authorization response, token response	IETF	RFC 6749
9	error_uri authorization response, token response	IETF	RFC 6749
10	grant_type token request	IETF	RFC 6749
11	access_token authorization response, token response	IETF	RFC 6749
12	token_type authorization response, token response	IETF	RFC 6749
13	expires_in authorization response, token response	IETF	RFC 6749
14	username token request	IETF	RFC 6749
15	password token request	IETF	RFC 6749
16	refresh_token token request, token response	IETF	RFC 6749

OAuth Authorization Endpoint Response Type Registry

This can be used to define OAuth Authorization Endpoint Response Type Registry. The response types are registered by experts with the required specification and if they are satisfied with the registration, only then they will publish the specification. The registration request will be sent to the @ietf.org for reviewing. The experts will either reject or accept the request within 14 days of the request.

Registration Template

The registration template contains specifications such as Type Name, Change Controller and Specification Document as defined in the above OAuth Access Token Types Registry section.

Initial Registry Contents

The following table shows the authorization endpoint response type registry containing the initial contents.

Sr.No.	Parameter Name	Change Controller	Specification Document
1	code	IETF	RFC 6749
2	token	IETF	RFC 6749

OAuth Extensions Error Registry

This can be used to define OAuth Extensions Error Registry. The error codes along with protocol extensions such as grant types, token types, etc. are registered by experts with the required specification. If they are satisfied with the registration, then they will publish the specification. The registration request will be sent to the @ietf.org for reviewing with subject ("Request for error code: example"). Experts will either reject or accept the request within 14 days of the request.

Registration Template

The registration template contains specifications such as Change Controller and Specification Document as defined in the above OAuth Access Token Types Registry section, except the following specifications −

Error Name − It is the name of the request.
Error Usage Location − It specifies the location of the error such as authorization code grant error response, implicit grant response or token error response, etc, which specifies where the error can be used.
Related Protocol Extension − You can use protocol extensions such as extension grant type, access token type, extension parameter, etc.

Previous Page Print Page