KantaraInitiative/wg-uma

Issues

• Returning RPT from Resource Server

  #355 opened 3 years ago by pedroigor
  3

• register the "UMA" auth scheme with IANA

  #362 opened 5 years ago by xmlgrrl
  2

• Scope of Current Extension Effort

  #364 opened 4 years ago by aleclaws
  3

• Need to edit Grant and FedAuthz specs to reflect that OAuth AS metadata spec is final

  #361 opened 6 years ago by xmlgrrl
  0

• Typo in Grant 2.0

  #360 opened 7 years ago by xmlgrrl
  0

• Comments received during AMB

  #359 opened 7 years ago by xmlgrrl
  4

• Authorization should be under the purview of the relying party

  #358 opened 7 years ago by xmlgrrl
  5

• Add request_submitted code example

  #356 opened 7 years ago by xmlgrrl
  0

• Remove set math parenthetical clarification

  #357 opened 7 years ago by xmlgrrl
  0

• No error for bad request body in FedAuthz RReg

  #354 opened 7 years ago by mrpotes
  16

• Undefined behaviour if submitted RPT for upgrade is invalid or expired

  #349 opened 7 years ago by joebandenburg
  5

• Which error code to return when candidate granted scopes is less than requested scopes

  #350 opened 7 years ago by joebandenburg
  3

• Terminology and diagram comments

  #335 opened 7 years ago by xmlgrrl
  5

• Variety of issues on revs 05

  #337 opened 7 years ago by xmlgrrl
  15

• No error defined for policy evaluation failed

  #340 opened 7 years ago by mrpotes
  13

• Security considerations could be made clearer

  #342 opened 7 years ago by mrpotes
  1

• UMA should not presume to know when scope is not an error

  #347 opened 7 years ago by mrpotes
  10

• No means no! (Alice's right to revoke)

  #348 opened 7 years ago by mrpotes
  6

• Why is PAT used for ticket and introspection?

  #352 opened 7 years ago by mrpotes
  4

• Editorial issues on FedAuthz from Cigdem

  #351 opened 7 years ago by xmlgrrl
  5

• ClientRegistered scopes should not be first class citizen

  #346 opened 7 years ago by mrpotes
  3

• Behaviour for bad claim_token_format values

  #345 opened 7 years ago by mrpotes
  3

• Behaviour for invalid/expired claim_token

  #344 opened 7 years ago by mrpotes
  3

• Token error response should defer to 6749

  #343 opened 7 years ago by mrpotes
  3

• request_submitted ticket parameter should not be a MUST

  #341 opened 7 years ago by mrpotes
  5

• Permission endpoint request implies array cannot be used for single resource identifier

  #339 opened 7 years ago by mrpotes
  1

• Incorrect Location value for resource creation response

  #338 opened 7 years ago by mrpotes
  1

• Make the permission ticket optional when "upgrading" the RPT for an UMA-native refresh flow

  #353 opened 7 years ago by xmlgrrl
  0

• Clarify that token_type_hint for RPT should be set to access_token

  #336 opened 7 years ago by xmlgrrl
  0

• Are the PCT definition(s) fully satisfying to implementers?

  #332 opened 7 years ago by xmlgrrl
  4

• FedAuthz Sec 9.2 should reference RFC 7519 as JWT Registry basis, not OIDCCore

  #330 opened 7 years ago by xmlgrrl
  2

• Registration request for JWT permissions claims incomplete and may have other issues

  #334 opened 7 years ago by xmlgrrl
  2

• How are client-contributed scopes mapped to resources during authorization assessment?

  #328 opened 7 years ago by xmlgrrl
  3

• Enhance redirect_user example description in Grant Sec 3.3.6

  #333 opened 7 years ago by xmlgrrl
  0

• FedAuthz Sec 9.3 should describe the item being registered as a "name"

  #331 opened 7 years ago by xmlgrrl
  1

• Xrefs to Sec 3.3.1 in Grant Sec 7.4.1 should be changed to Sec 3.3.6

  #329 opened 7 years ago by xmlgrrl
  1

• An array of (what)

  #327 opened 7 years ago by xmlgrrl
  6

• Definition of permission ticket

  #326 opened 7 years ago by xmlgrrl
  0

• Editorial items from Justin

  #323 opened 8 years ago by xmlgrrl
  8

• Editorial cleanup items pre-Draft Recommendation stage

  #319 opened 8 years ago by xmlgrrl
  1

• Need a security consideration for the state parameter

  #316 opened 8 years ago by xmlgrrl
  3

• Human-readable scope display should be explicit

  #320 opened 8 years ago by xmlgrrl
  2

• Should our token introspection object permissions structure be a MUST now?

  #322 opened 8 years ago by xmlgrrl
  1

• Errors are ill-defined

  #321 opened 8 years ago by xmlgrrl
  2

• Change resource description's scopes parameter to resource_scopes

  #318 opened 8 years ago by xmlgrrl
  1

• Possible to get an RPT for a resource with no scopes?

  #317 opened 8 years ago by xmlgrrl
  2

• Say what happens when claims_redirect_uri is missing

  #315 opened 8 years ago by xmlgrrl
  3

• Correct rpt description

  #314 opened 8 years ago by xmlgrrl
  2

• Move from FedAuthz to Grant some RS requirements/tasks

  #313 opened 8 years ago by xmlgrrl
  3

• Consider removing basic SHOULD language re HTTP responses

  #312 opened 8 years ago by xmlgrrl
  2