openid / openid/authzen

ARAP does too many things

Open
#520 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

access-requests
Dominant language
TypeScript
Stars
160
Forks
40
Avg merge
2d 3h
Merged PRs (30d)
23

Description

Although I definitively see the value of a protocol for requesting access dynamically, the proposed AARP profile does too much. In particular: the Catalog references, which could be a separate profile I think, or left at the discretion of implementers. Its usage of HTTP may not be appropriate for some implementations (why not provide a GraphQL endpoint and schema instead for example, which may actually be more appropriate, since GraphQL Schema are introspectable, and standard?). Or maybe the actual missing information must be accessed via MCP, or any other protocol...

I don't think there is way to create a 1-size-fits-all definition here, and would much rather remove the whole catalog concept from the spec, and let implementers be flexible here.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue discusses the proposed AARP profile, Catalog references, HTTP, GraphQL endpoints and schemas, and MCP, but names no files or tests. Start by reading the current AARP profile and its catalog section, then review the discussion about protocol boundaries. Done would require an agreed decision on whether the catalog concept remains in the specification and how implementers should handle it.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql
Domain
api, backend-api-design, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.