Hi Mike,
HP had 2 points of feedback:
* Section 4.3 "Scoped Access Tokens" describes how either scopes or token exchange can be used to limit scope. What isn't clear is how a client will know when one or the other are being used? The Client may not understand the hidden semantic meaning of the types of scopes. If Clients, Printers, Proxies and Systems MUST support scopes _and_ Token Exchange, do they need to know which one is being used by the authorization server? Are there requirements on the Authorization Servers? Is it impractical to just mandate Token Exchange for Clients, Printers, Proxies, Systems and Authorization Servers?
* Section 7.3 "Authorization Flows" mentions Device Authorization Grant. Can this be updated to either indicate how a DAG would be incorporated into a print related use case? If it ends up "not working", can we remove mention of DAG?
Apologies again for not being present yesterday to discuss these points of feedback in person. Thanks for your efforts!
Smith
/**
Smith Kennedy
HP Inc.
*/
On Aug 18, 2025, at 8:44 AM, Michael Sweet via ipp <ipp at pwg.org> wrote:
CAUTION: External Email
All,
I have posted an updated stable draft of the IPP OAuth Extensions v1.0 (OAUTH) to:
https://ftp.pwg.org/pub/pwg/ipp/wd/wd-ippoauth10-20250818.docxhttps://ftp.pwg.org/pub/pwg/ipp/wd/wd-ippoauth10-20250818.pdfhttps://ftp.pwg.org/pub/pwg/ipp/wd/wd-ippoauth10-20250818-rev.pdf
With luck this will be the draft that goes to PWG Formal Vote after the next IPP workgroup conference call on August 28...
________________________
Michael Sweet
_______________________________________________
ipp mailing list
ipp at pwg.orghttps://www.pwg.org/mailman/listinfo/ipp
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.pwg.org/pipermail/ipp/attachments/20250829/68ce5c0f/attachment.html>