Received-SPF: pass (google.com: domain of aaron@geoloqi.com designates
 10.236.72.167 as permitted sender) client-ip=10.236.72.167; 
Received-SPF: pass (google.com: domain of aaron@geoloqi.com designates
 10.236.181.74 as permitted sender) client-ip=10.236.181.74; 
MIME-Version: 1.0
In-Reply-To: <B691F720-809F-4A9E-8C8E-6BF98EE68F07@appmuscle.com>
References: <B691F720-809F-4A9E-8C8E-6BF98EE68F07@appmuscle.com>
Date: Thu, 1 Mar 2012 04:20:39 +0000
Message-ID: <CAGBSGjrKTpXsLSO_cn1u__rJo55QFPhoVxZUgqCMPe9bePkd8A@mail.gmail.com>
From: Aaron Parecki <aaron@geoloqi.com>
To: Pete Clark <pete@appmuscle.com>
Content-Type: multipart/alternative; boundary=20cf305b127e5d79c404ba26c8a5
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Securing APIs with OAuth 2.0
Precedence: list

--20cf305b127e5d79c404ba26c8a5
Content-Type: text/plain; charset=UTF-8

I believe this one https://github.com/quizlet/oauth2-php is the most
up-to-date PHP library, although you might check around for forks of it
since I haven't checked up on it in a month or so.

Aaron Parecki


On Wednesday, February 29, 2012, Pete Clark wrote:

> Hey all, I've joined the list because I'd like to use OAuth 2 to implement
> security for a new set of REST APIs I'm developing for a client.  I'm
> coding with PHP, but my questions are more general.  Right now, there will
> be only one web site that uses the APIs, in a server-to-server fashion, and
> currently we don't have a need for a third party application to gain access
> to user data, such that a user would need to authorize that app.  We do,
> however, want to have that ability down the road.  My question is, can I
> still use OAuth 2 in some way to implement our first phase?  From what I've
> read, it seems like the "client credentials" flow is the one I want to use
> for now.  Can someone:
>
> 1) Confirm that that's what I should use for this first phase?
> 2) Point me to an implementation of this flow (in any language) that I
> could use or port to PHP?  I've found some libraries for php but can't
> really tell, being new, if they offer the "client credentials" flow
> 3) Answer one more question.. Will using the client credentials flow now
> allow me to move to one of the user-authorizes-external-app flows down the
> road without having to reimplement or throw away the client credentials
> flow code?
>
> I apologize for all the questions, but these would really help point me in
> the right direction.. Thank you for reading!
>
> Sincerely,
> Pete
>
>
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org <javascript:;>
> https://www.ietf.org/mailman/listinfo/oauth
>

--20cf305b127e5d79c404ba26c8a5
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

I believe this one <a href=3D"https://github.com/quizlet/oauth2-php">https:=
//github.com/quizlet/oauth2-php</a> is the most up-to-date PHP library, alt=
hough you might check around for forks of it since I haven&#39;t checked up=
 on it in a month or so.<div>
<br></div><div>Aaron Parecki</div><div><br><br>On Wednesday, February 29, 2=
012, Pete Clark  wrote:<br><blockquote class=3D"gmail_quote" style=3D"margi=
n:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hey all, I&#39;ve=
 joined the list because I&#39;d like to use OAuth 2 to implement security =
for a new set of REST APIs I&#39;m developing for a client. =C2=A0I&#39;m c=
oding with PHP, but my questions are more general. =C2=A0Right now, there w=
ill be only one web site that uses the APIs, in a server-to-server fashion,=
 and currently we don&#39;t have a need for a third party application to ga=
in access to user data, such that a user would need to authorize that app. =
=C2=A0We do, however, want to have that ability down the road. =C2=A0My que=
stion is, can I still use OAuth 2 in some way to implement our first phase?=
 =C2=A0From what I&#39;ve read, it seems like the &quot;client credentials&=
quot; flow is the one I want to use for now. =C2=A0Can someone:<br>

<br>
1) Confirm that that&#39;s what I should use for this first phase?<br>
2) Point me to an implementation of this flow (in any language) that I coul=
d use or port to PHP? =C2=A0I&#39;ve found some libraries for php but can&#=
39;t really tell, being new, if they offer the &quot;client credentials&quo=
t; flow<br>

3) Answer one more question.. Will using the client credentials flow now al=
low me to move to one of the user-authorizes-external-app flows down the ro=
ad without having to reimplement or throw away the client credentials flow =
code?<br>

<br>
I apologize for all the questions, but these would really help point me in =
the right direction.. Thank you for reading!<br>
<br>
Sincerely,<br>
Pete<br>
<br>
<br>
<br>
_______________________________________________<br>
OAuth mailing list<br>
<a href=3D"javascript:;" onclick=3D"_e(event, &#39;cvml&#39;, &#39;OAuth@ie=
tf.org&#39;)">OAuth@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/oauth" target=3D"_blank">h=
ttps://www.ietf.org/mailman/listinfo/oauth</a><br>
</blockquote></div>

--20cf305b127e5d79c404ba26c8a5--