[OAUTH-WG] Redirect to STS

Pieter De Rycke <phdrycke@gmail.com> Mon, 22 August 2016 07:25 UTC

MIME-Version: 1.0
From: Pieter De Rycke <phdrycke@gmail.com>
Date: Mon, 22 Aug 2016 09:24:57 +0200
Message-ID: <CAAt8o2B-R3xeLGLqfUFV9ptc4P6hkE9bLbYJ5wVkxh3EqjiKbw@mail.gmail.com>
To: "Oauth@ietf.org" <Oauth@ietf.org>
Content-Type: multipart/alternative; boundary="94eb2c0758b2ff4e30053aa3f11c"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/AF4KUuoSlDpyPaP__NIUxBn_do4>
Subject: [OAUTH-WG] Redirect to STS
Precedence: list

Hello,

This might be a stupid question, but why is the redirect  happening in
OAuth2 spec (+ SAML previously) to the STS login page for cross domain SSO?
Our marketing department is against this redirect as it means that users
are jumping out of the e-commerce shopping flow. They would prefer a login
mechanism in which the login page remains embedded in the e-commerce
websites. Having flexible in login options is not necessary for us. We do
not expect to move away from username/password anytime soon.

We are thinking about an embedded login page, that does a HTTP POST to the
STS (to have the cross domain SSO cookies), but render the login form
within the ecommerce website. Was there any good reason why the OAuth2/SAML
specs are redirecting to an STS hosted page, except flexibility in login
options and the STS as trusted authentication system. We are considering
such a custom solution, but at the same we would to be sure that we are not
missing some important security aspects that might make our authentication
solution vulnerable.

Kind regards,
Pieter

[OAUTH-WG] Redirect to STS Pieter De Rycke