Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token

[Justin Richer <[e-mail]>]

It's a difference between the front channel and the back channel. See 
attached diagram for a very high level overview that I've used in a few 
talks.

The browser is for flows where you need the user and their 
authentication present in order to make the connection, such as the 
authz code or implicit flows. The idea is that you, as the client, fire 
off a web browser to send the user over to the authorization endpoint 
directly, where they authenticate with the authorization server using 
whatever mechanism they can. This lets you use two factor, certificates, 
openid, username/password, whatever. The client doesn't have to support 
or see any of this because it's all happening in a browser between the 
user and the authorization server, which probably already has a direct 
user log in mechanism it has access to.

As has been pointed out, you can do OAuth2 without involving the front 
channel at all by using the client credentials, resource owner 
credentials, or assertion flows. None of these sound like they fit what 
you want to do, though. And it's trivial to pop open a browser in most 
platforms; the trick has historically been getting the callback from the 
site, which is less of a problem on mobile platforms.

Side note, OAuth is not really RESTful, but its tokens are easily 
compatible with RESTful APIs.

  -- Justin

On 04/19/2012 05:37 PM, Lewis Adam-CAL022 wrote:
>
> Hi Justin,
>
> There is one thing I have not understood about the whole external 
> browser vs. embedded browser guidance ... and that is, why is **any** 
> browser needed?  Java for example has an HTTP library, and OAuth is 
> RESTful.  So why is it necessary to require the web browser at all, 
> whether external or embedded?  Why can't my native client make RESTful 
> API calls to the AS and RS natively?
>
> Tx!
>
> adam
>
> *From:*Justin Richer [mailto:[e-mail]]
> *Sent:* Friday, April 13, 2012 11:38 AM
> *To:* Lewis Adam-CAL022
> *Cc:* [e-mail]
> *Subject:* Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token
>
> If the mobile device has a web browser (such as a smart phone), then 
> this is pretty easy, and you've got a couple of options.
>
> One of the best options when the token is on behalf of an end user is, 
> in my opinion, to use the authorization code flow like this: First, 
> register what's called a "public client" with your server -- so you'll 
> get an ID but not a client secret. With that client ID, register a 
> custom-scheme callback URI, like "myapp://oauthcallback", and register 
> your app on the device as the handler for "myapp".
>
> In your application, to start things off, you fire off a web browser 
> to the authorization server's authorization endpoint. The user logs in 
> to the authorization server through the web browser, approves this 
> copy of your app, and gets redirected to 
> "myapp://oauthcallback?code=basdf132". Your app grabs the "myapp://" 
> url and plucks the authorization code off the end of it. Your app then 
> takes that code and sends it in the background to the token endpoint 
> to exchange for a token.
>
> Some key points:
>
> 1) You need to have access to a web browser on the platform, and it's 
> considered best practice to push the user to the external browser 
> application on the platform instead of embedding one. There are a 
> couple paragraphs in the spec's security considerations section that 
> talk about this.
> 2) Your app is "public" because you can't publish it with a secret at 
> configuration time. It can, however, keep the tokens secret at runtime.
> 3) You need to be very careful with how you store the tokens on the 
> device -- they need to be in a trusted space where other apps on the 
> device can't sniff them out.
> 4) Another app can try to register "myapp://" and intercept your code 
> on the way through, so make sure your codes are all one time use and 
> short lived.
>
> None of this is just theoretically possible, people are doing it 
> today. What libraries and stuff you'd be after depends wholly on your 
> platform (both server and client side).
>
>  -- Justin
>
> On 04/12/2012 03:01 PM, Lewis Adam-CAL022 wrote:
>
> Hi all,
>
> I've been talking to some of you off line about this already, but I 
> need some help in terms of implementation.  I would like to use OAuth 
> as a means to get either a JWT or SAML token to a client running on a 
> handheld device.  This is something that I'm looking to prototype (as 
> part of a larger project) beginning this week.  So, it is important to 
> me to understand the divide between what is theoretically possible and 
> what is actually possible.
>
> Anybody aware of any implementations out there, either vendor or open 
> source, that I can use for this?
>
> Tx!
> adam
>
>
>
>
> _______________________________________________
> OAuth mailing list
> [e-mail]  <mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/oauth
>