IETF Logo Mail Archive

Re: [OAUTH-WG] Using Oauth2 token to SOAP web services

Phil Hunt <phil.hunt@oracle.com> Mon, 19 March 2012 13:23 UTC

Return-Path: <phil.hunt@oracle.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD93F21F84DA for <oauth@ietfa.amsl.com>; Mon, 19 Mar 2012 06:23:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.673
X-Spam-Level:
X-Spam-Status: No, score=-9.673 tagged_above=-999 required=5 tests=[AWL=-0.470, BAYES_00=-2.599, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FhIGmotpy-eE for <oauth@ietfa.amsl.com>; Mon, 19 Mar 2012 06:23:55 -0700 (PDT)
Received: from acsinet15.oracle.com (acsinet15.oracle.com [141.146.126.227]) by ietfa.amsl.com (Postfix) with ESMTP id 1446121F84C5 for <oauth@ietf.org>; Mon, 19 Mar 2012 06:23:55 -0700 (PDT)
Received: from acsinet22.oracle.com (acsinet22.oracle.com [141.146.126.238]) by acsinet15.oracle.com (Sentrion-MTA-4.2.2/Sentrion-MTA-4.2.2) with ESMTP id q2JDNq8W013153 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 19 Mar 2012 13:23:53 GMT
Received: from acsmt356.oracle.com (acsmt356.oracle.com [141.146.40.156]) by acsinet22.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id q2JDNp9b027343 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 19 Mar 2012 13:23:52 GMT
Received: from abhmt118.oracle.com (abhmt118.oracle.com [141.146.116.70]) by acsmt356.oracle.com (8.12.11.20060308/8.12.11) with ESMTP id q2JDNpMi014327; Mon, 19 Mar 2012 08:23:51 -0500
Received: from [192.168.1.125] (/24.87.212.4) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 19 Mar 2012 06:23:51 -0700
References: <1db661c5-2e54-470e-8104-ee8e7ae10e86@default> <A8BFFBB5-9912-468C-AB42-702DA368D59F@oracle.com> <12509c43-163e-43a6-bbf3-60d6daa1db43@default> <FB4F059C-6E02-4240-98A6-069CCA700186@gmx.net>
In-Reply-To: <FB4F059C-6E02-4240-98A6-069CCA700186@gmx.net>
Mime-Version: 1.0 (1.0)
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"
Message-Id: <835C2B6E-3A48-4894-A75E-B802FB12DD1C@oracle.com>
X-Mailer: iPhone Mail (9B179)
From: Phil Hunt <phil.hunt@oracle.com>
Date: Mon, 19 Mar 2012 06:23:50 -0700
To: Hannes Tschofenig <hannes.tschofenig@gmx.net>
X-Source-IP: acsinet22.oracle.com [141.146.126.238]
X-Auth-Type: Internal IP
X-CT-RefId: str=0001.0A090202.4F673369.0077,ss=1,re=0.000,fgs=0
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Using Oauth2 token to SOAP web services
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 19 Mar 2012 13:23:56 -0000

There's going to be a lot of mixed environments for some time. Particularly an issue at the boundaries between classic soap services and new restful services.  

Phil

On 2012-03-19, at 0:05, Hannes Tschofenig <hannes.tschofenig@gmx.net> wrote:

> Hi Grant, 
> 
> IMHO the main reason why the OAuth specification does not standardize OAuth usage specially for SOAP is because most people by now realized that SOAP, as another layer of encapsulation, does not add a lot of value. 
> 
> Ciao
> Hannes
> 
> On Mar 19, 2012, at 6:15 AM, Grant Yang wrote:
> 
>> Thank you very much Phil!
>> 
>> The thing is, the Oauth spec just mentioned putting the Access Token into HTTP header “Authorization”. I don’t think it applies to SOAP as this header is not visible from SOAP stack perspective.
>> 
>> So, when we talking about the soap header, are we talking about the header used by WS-Security? Could you please be kindly providing me one example on putting the Access Token into SOAP header and let me know which product is currently using this mechanism?
>> 
>> Thanks a lot,
>> Grant.
>> 
>> From: Phil Hunt 
>> Sent: Thursday, March 15, 2012 11:53 PM
>> To: Grant Yang
>> Subject: Re: [OAUTH-WG] Using Oauth2 token to SOAP web services
>> 
>> Grant,
>> 
>> You put it in the soap header of course in the same spot as any other credential.  :-)
>> 
>> Phil
>> 
>> @independentid
>> www.independentid.com
>> phil.hunt@oracle.com
>> 
>> 
>> 
>> 
>> 
>> On 2012-03-14, at 10:41 PM, Grant Yang wrote:
>> 
>> 
>> Hi all,
>> 
>> We were discussing the possibility to use Oauth2 token on SOAP in our product.
>> 
>> The preferred way in mentioned in RFC is of course to put it to HTTP Authorization header, but in this case it will beyond the scope of SOAP stack and I am not sure it shall be the correct way to go. It is also recognized that there is some implementation (such as salesforce) is using some SOAP header (“sessionId”) to put this token, but it looks like a private implementation and I did not find any specification supporting it.
>> 
>> Could any experts here illustrate any organization or forum is working on using Oauth2 token for SOAP request? As there are quite some legacy SOAP based web services, hopefully it is a question makes sense for you as well.
>> 
>> Thoughts?
>> 
>> Grant Yang
>> Architect, SDP of ORACLE Communications
>> 
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
>> 
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
>

v2.23.0 | Report a Bug | By Email