Re: [mmox] OGP scalability concerns

[Jon Watte <[e-mail]>]

Christian Scholz wrote:
> The redirect setup is only one example of obtaining the OAuth token. 
> You can do it whatever way you want to (the new version of the spec 
> also makes that clearer as it starts with just the way you actually do 
> authorized requests and only explains in the second part the redirect 
> mechanism).
>

When I register as a service provider for an OAuth service, I have to 
register a callback URL. That seems pretty hard-coded into the actual 
implementation to me. That service provider won't work with a service 
that doesn't have a user-visible callbacl URL.

> But if you look at e.g. iMovie and how it uploads movies to YouTube 
> you have an example of how a desktop app can do it (although it's not 
> using OAuth I think but probably Google AuthSub but it's basically the 
> same).
>

The problem is not the desktop app not being reachable; the problem is 
the service requesting authentication not being reachable from the 
authentication provider.

>
> I am not sure though I understand the question. You might also be 
> talking about the server being behind a firewall and not reachable by 
> the client. But then I guess you need some ports open anyway for the 
> client to be able to connect any way.

The client can get to the service requesting authentication. The service 
can get to the authentication provider. The client can get to the 
authentication provider. The authentication provider can /not/ get to 
the service. Thus, any callback scheme between the services may fail. 
The current implementation of OAuth in the services I've seen uses this 
callback with a registered URL, so this is not something you can change 
by only changing the client, or only changing the requesting service AFAICT.

Sincerely,

jw