Re: [kitten] SASL OAuth: Next Steps

[William Mills <[e-mail]>]

First, lemme say I'm happy to have active discussion on this!  More inline...


>________________________________
> From: Florian Zeitz <[e-mail]>
>To: [e-mail] 
>Sent: Sunday, March 11, 2012 5:01 PM
>Subject: Re: [kitten] SASL OAuth: Next Steps

<snip />


>Nom, tasty TOFU.
>
>Hi,
>
>I have a question/suggestion concerning this.
>I'm admittedly somewhat reluctant to ask at this point, because I have
>not found time to read enough of the OAuth RFCs to get the full picture,
>but please bear with me.
>
>It seems we have a relatively well defined list of necessary
>information. If this is put into JSON it appears to me that this JSON,
>except for ordering of entries will not be particularly flexible.
>Is there a compelling reason not to go back to a good old comma
>separated key value pair list at that point?

It's well defined for the current token profiles, yes, but what about for
extensions and new auth profiles?  I wanted to avoid having to write in a
mapping per OAuth auth profile from the data in band to how it's used in
authentication.



>
>The reason I ask is that having either a HTTP or a JSON parser (even a
>limited one) just for a SASL mechanism seems like enormous over
>engineering to me.


On the server side it's probably more work, but on the client you have to do 

HTTP and JSON anyway.


>This particularly struck me when people were discussing token based
>authentication at the last XMPP Summit. People were suggesting we might
>be able to reuse SASL OAuth for this under the assumption that it would
>just amount to sending a single token string over the wire.
>I find it somewhat irritating that at this point in time it is very
>significantly more complex than that.


The simplest token case, Bearer, could work this way.  I don't think anything 

else does.


We might be able to do it differently, but I was using this also as proposal 

for how to do OAuth 2 discovery.  Will XMPP want auth endpoint discovery?


-bill



>
>Regards,
>Florian Zeitz
>_______________________________________________
>Kitten mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/kitten
>
>
>