If the mobile device has a web browser (such as a smart phone), then
this is pretty easy, and you've got a couple of options.
One of the best options when the token is on behalf of an end user is,
in my opinion, to use the authorization code flow like this: First,
register what's called a "public client" with your server -- so you'll
get an ID but not a client secret. With that client ID, register a
custom-scheme callback URI, like "myapp://oauthcallback", and register
your app on the device as the handler for "myapp".
In your application, to start things off, you fire off a web browser to
the authorization server's authorization endpoint. The user logs in to
the authorization server through the web browser, approves this copy of
your app, and gets redirected to "myapp://oauthcallback?code=basdf132".
Your app grabs the "myapp://" url and plucks the authorization code off
the end of it. Your app then takes that code and sends it in the
background to the token endpoint to exchange for a token.
Some key points:
1) You need to have access to a web browser on the platform, and it's
considered best practice to push the user to the external browser
application on the platform instead of embedding one. There are a couple
paragraphs in the spec's security considerations section that talk about
this.
2) Your app is "public" because you can't publish it with a secret at
configuration time. It can, however, keep the tokens secret at runtime.
3) You need to be very careful with how you store the tokens on the
device -- they need to be in a trusted space where other apps on the
device can't sniff them out.
4) Another app can try to register "myapp://" and intercept your code on
the way through, so make sure your codes are all one time use and short
lived.
None of this is just theoretically possible, people are doing it today.
What libraries and stuff you'd be after depends wholly on your platform
(both server and client side).
-- Justin
On 04/12/2012 03:01 PM, Lewis Adam-CAL022 wrote:
Hi all,
I've been talking to some of you off line about this already, but I
need some help in terms of implementation. I would like to use OAuth
as a means to get either a JWT or SAML token to a client running on a
handheld device. This is something that I'm looking to prototype (as
part of a larger project) beginning this week. So, it is important to
me to understand the divide between what is theoretically possible and
what is actually possible.
Anybody aware of any implementations out there, either vendor or open
source, that I can use for this?
Tx!
adam
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
