IETF Logo Mail Archive

Re: [OAUTH-WG] Flowchart for legs of OAuth

Marius Scurtescu <mscurtescu@google.com> Fri, 01 April 2011 00:59 UTC

Return-Path: <mscurtescu@google.com>
X-Original-To: oauth@core3.amsl.com
Delivered-To: oauth@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 908233A6B73 for <oauth@core3.amsl.com>; Thu, 31 Mar 2011 17:59:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.357
X-Spam-Level:
X-Spam-Status: No, score=-105.357 tagged_above=-999 required=5 tests=[AWL=-0.620, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, SARE_LWSHORTT=1.24, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OCOAx95F5RWQ for <oauth@core3.amsl.com>; Thu, 31 Mar 2011 17:59:09 -0700 (PDT)
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by core3.amsl.com (Postfix) with ESMTP id 584483A6B65 for <oauth@ietf.org>; Thu, 31 Mar 2011 17:59:09 -0700 (PDT)
Received: from kpbe14.cbf.corp.google.com (kpbe14.cbf.corp.google.com [172.25.105.78]) by smtp-out.google.com with ESMTP id p3110mcb000878 for <oauth@ietf.org>; Thu, 31 Mar 2011 18:00:48 -0700
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1301619649; bh=nuWgCI8Pye3HhNMNfx9etb6uQMk=; h=MIME-Version:In-Reply-To:References:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=BzUSjHh6huj0NwUZeXvyb3qzFDjOu8QcR97kcwXTPEwlGlA65meIfV7GBph1vKZIL q10/jQ762MML2Y9HTvVgQ==
Received: from ywi6 (ywi6.prod.google.com [10.192.9.6]) by kpbe14.cbf.corp.google.com with ESMTP id p3110aWD031960 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <oauth@ietf.org>; Thu, 31 Mar 2011 18:00:47 -0700
Received: by ywi6 with SMTP id 6so1178633ywi.3 for <oauth@ietf.org>; Thu, 31 Mar 2011 18:00:47 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=11TPPEKLs4VYIoyl6IObYspa/Dh1n1UWzvLKCQ/3TDw=; b=Y84WUvfi9v7WsuTPw84MSGJDpSQF6gfy0sqwT3yvyuS1shC8WPfIYPNal1jvpXw7mb hIKtSJK5s8SWectOtaMw==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=q1zJHLChx/Yg6gKh7WmLMVY/iVSJzSU+MjVeTQ9uKZqEJ6FAy+Tbc6Vwgg9KUKndny uZAEn7AF5bSONiUNChVA==
Received: by 10.101.66.2 with SMTP id t2mr2478940ank.60.1301619647107; Thu, 31 Mar 2011 18:00:47 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.100.34.4 with HTTP; Thu, 31 Mar 2011 18:00:27 -0700 (PDT)
In-Reply-To: <7616C235-2913-4EE0-A710-F47A4CC9E424@oracle.com>
References: <22FB565B-A701-4502-818F-15164D9E201A@oracle.com> <AANLkTimGjiCGk5dpA=YVzq5vDkLR2+caSz=pZ5WiZO9H@mail.gmail.com> <3C84AD7A-F00F-43EC-AAD3-AD2DCFB46B0E@oracle.com> <90C41DD21FB7C64BB94121FBBC2E7234464F432BB0@P3PW5EX1MB01.EX1.SECURESERVER.NET> <4D84F7E2.6090305@redhat.com> <16B9A882-6204-4CBD-B7E3-1D806AF5056C@oracle.com> <4D8A5054.4050006@lodderstedt.net> <BANLkTiniuuRXtkzLubgOjVursVtOGjFe6A@mail.gmail.com> <7616C235-2913-4EE0-A710-F47A4CC9E424@oracle.com>
From: Marius Scurtescu <mscurtescu@google.com>
Date: Thu, 31 Mar 2011 18:00:27 -0700
Message-ID: <BANLkTi=XyF25vB6qKX2q8iOpEaZ1yQx9Jw@mail.gmail.com>
To: Phil Hunt <phil.hunt@oracle.com>
Content-Type: text/plain; charset="ISO-8859-1"
X-System-Of-Record: true
Cc: oauth@ietf.org
Subject: Re: [OAUTH-WG] Flowchart for legs of OAuth
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 01 Apr 2011 00:59:10 -0000

On Thu, Mar 31, 2011 at 4:56 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
> Done.
>
> It isn't quite what the flow shows in the earlier diagram. I was originally avoiding client type and trying to focus on section 4 options.
>
> But this should be a better diagram.
>
> http://independentidentity.blogspot.com/2011/03/oauth-flows-extended.html

A native app with no client secret is still advised to use the
implicit grant, which is wrong IMO.

The right question I think is "does the client need long term offline access"?

JavaScript clients typically don't need offline access (only with the
user at the browser). Some native apps and web apps could be OK with a
short term offline access, one off import for example.

Marius

v2.23.0 | Report a Bug | By Email