[OAUTH-WG] Info on how to implement a server

2019-08-17 Thread Salz, Rich
What’s the WG consensus (heh) on the best guide to adding OAUTH support to an existing server so that it can act as an identity provider? Which version of oauth is most widely deployed by relying parties these days? I want to add OAUTH support to the IETF datatracker. Thanks for any pointers.

Re: [OAUTH-WG] Info on how to implement a server

2019-08-17 Thread John Bradley
The openID Connect kind of OAuth server. OAuth on its own is not designed to be secure for identity federation. John B. On 8/17/2019 1:23 PM, Salz, Rich wrote: > > What’s the WG consensus (heh) on the best guide to adding OAUTH > support to an existing server so that it can act as an identity >

Re: [OAUTH-WG] Info on how to implement a server

2019-08-17 Thread Hans Zandbelt
indeed OAuth != identity see https://oauth.net/articles/authentication/ Hans. On Sat, Aug 17, 2019 at 8:31 PM John Bradley wrote: > The openID Connect kind of OAuth server. > > OAuth on its own is not designed to be secure for identity federation. > > John B. > On 8/17/2019 1:23 PM, Salz, Rich

Re: [OAUTH-WG] Info on how to implement a server

2019-08-18 Thread Salz, Rich
I don’t want to get distracted from my main goal. Thanks. From: Hans Zandbelt Date: Saturday, August 17, 2019 at 2:34 PM To: John Bradley Cc: "oauth@ietf.org" Subject: Re: [OAUTH-WG] Info on how to implement a server indeed OAuth != identity see https://oauth.net/articles/auth

Re: [OAUTH-WG] Info on how to implement a server

2019-08-18 Thread Dick Hardt
ley > *Cc: *"oauth@ietf.org" > *Subject: *Re: [OAUTH-WG] Info on how to implement a server > > > > indeed OAuth != identity see https://oauth.net/articles/authentication/ > <https://urldefense.proofpoint.com/v2/url?u=https-3A__oauth.n

Re: [OAUTH-WG] Info on how to implement a server

2019-08-18 Thread Salz, Rich
As I said at the start of the thread: I want to add OAUTH support to the datatracker. From: Dick Hardt Date: Sunday, August 18, 2019 at 4:47 PM To: Rich Salz Cc: Hans Zandbelt , John Bradley , "oauth@ietf.org" Subject: Re: [OAUTH-WG] Info on how to implement a server What is the

Re: [OAUTH-WG] Info on how to implement a server

2019-08-18 Thread Dick Hardt
e: *Sunday, August 18, 2019 at 4:47 PM > *To: *Rich Salz > *Cc: *Hans Zandbelt , John Bradley < > ve7...@ve7jtb.com>, "oauth@ietf.org" > *Subject: *Re: [OAUTH-WG] Info on how to implement a server > > > > What is the goal? > > > > On Sun, Aug 18,

Re: [OAUTH-WG] Info on how to implement a server

2019-08-18 Thread Aaron Parecki
> > > From: Hans Zandbelt > Date: Saturday, August 17, 2019 at 2:34 PM > To: John Bradley > Cc: "oauth@ietf.org" > Subject: Re: [OAUTH-WG] Info on how to implement a server > > > > indeed OAuth != identity see https://oauth.net/articles/authentication/ >

Re: [OAUTH-WG] Info on how to implement a server

2019-08-18 Thread Salz, Rich
Not to be pedantic, but adding OAuth support is a mechanism in support of a goal. What's the end goal? * Letting third party apps use the datatracker API? * Letting people sign in to other apps with a datatracker account? The latter. __

Re: [OAUTH-WG] Info on how to implement a server

2019-08-18 Thread Salz, Rich
>Do you want to enable applications to call datatracker APIs? Not me, no. But I know of a couple that will be able to benefit ___ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth

Re: [OAUTH-WG] Info on how to implement a server

2019-08-18 Thread Dick Hardt
On Sun, Aug 18, 2019 at 2:29 PM Salz, Rich wrote: > Not to be pedantic, but adding OAuth support is a mechanism in support > of a goal. What's the end goal? > > * Letting third party apps use the datatracker API? > * Letting people sign in to other apps with a datatracker account?

Re: [OAUTH-WG] Info on how to implement a server

2019-08-18 Thread Salz, Rich
>Then you want OpenID Connect great, thank you for the pointer. ___ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth