Re: [mmox] OGP scalability concerns

[Christian Scholz <[e-mail]>]

Jon Watte schrieb:
> Christian Scholz wrote:
>> Another option would be to join forces with the OAuth group at IETF 
>> and check on how we could add identity to OAuth (there is discussion 
>> about that already). Eventually this might be an easier choice and you 
>> could do authorization in one step, at least for some centralized 
>> services.
> 
> The first question is: does the OAuth "callback" URL work in a VW sense? 
> At a minimum, this means that a VW needs to have a publicly available 
> *incoming* URL for receiving authentication tokens. For a VW behind a 
> firewall, that's not necessarily true. (Then again, OAuth doesn't work 
> for an intranet web site behind a firewall, either)

The redirect setup is only one example of obtaining the OAuth token. You 
can do it whatever way you want to (the new version of the spec also 
makes that clearer as it starts with just the way you actually do 
authorized requests and only explains in the second part the redirect 
mechanism).

But if you look at e.g. iMovie and how it uploads movies to YouTube you 
have an example of how a desktop app can do it (although it's not using 
OAuth I think but probably Google AuthSub but it's basically the same).

Basically instead of having a callback URL the client will simply wait 
until the user has finished authorization in the web browser. The server 
then might tell him to go back to the client and click "Continue". After 
that the client will contact the server again and will try to exchange 
the request token for an access token which only will work if the user 
authorized it.

I am not sure though I understand the question. You might also be 
talking about the server being behind a firewall and not reachable by 
the client. But then I guess you need some ports open anyway for the 
client to be able to connect any way.

-- Christian



-- 
COM.lounge GmbH
http://comlounge.net
Hanbrucher Strasse 33, 52064 Aachen
Amtsgericht Aachen HRB 15170
Geschäftsführer: Dr. Ben Scheffler, Christian Scholz

email: [e-mail]
fon: [phone]
fax: [phone]

personal email: [e-mail]
personal blog: http://mrtopf.de/blog
personal podcasts: http://openweb-podcast.de, http://datawithoutborders.net