Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2104\))
From: John Bradley <ve7jtb@ve7jtb.com>
In-Reply-To: <FB1A52A9-AE47-4123-BFD1-36B58D61FB4A@matake.jp>
Date: Sat, 21 Nov 2015 11:00:33 -0300
Content-Transfer-Encoding: quoted-printable
Message-Id: <EEE00718-28EC-4720-839C-E8AD10558778@ve7jtb.com>
References: <FB1A52A9-AE47-4123-BFD1-36B58D61FB4A@matake.jp>
To: nov matake <nov@matake.jp>
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/kJ4tT11ZsMpgD2tRBbWiGS-PA8g>
Cc: oauth@ietf.org
Subject: Re: [OAUTH-WG] allowing offline access for native app & its backend
 server
Precedence: list

There is a missing step in this flow that also needs to be considered, =
and that is how the app authenticates to the backend server.

In the Google case they are providing a JWT/id_token to the client from =
the token endpoint for the client to use for it=E2=80=99s authentication =
to it=E2=80=99s backend.

It would not be a huge step to have the backend then use token exchange =
along with it=E2=80=99s credentials to exchange that for a refresh =
token.

I can see giving out two codes and we have discussed that in the past. =20=


This topic should perhaps be added to the list of things for =
rechartering.   There are a lot of interactions and posable security =
side effects that need to be looked at.

John B.


> On Nov 21, 2015, at 9:55 AM, nov matake <nov@matake.jp> wrote:
>=20
> Hi OAuthers,
>=20
> I=E2=80=99m thinking the way to issue refresh tokens both to native =
app and its backend server at same time.
> I have 2 ideas currently.
>=20
> 1. including 2 audience in a single authorization code, and allow =
using the code once per the audience.
> 2. issuing 2 code one for native app, one for backend server.
>=20
> 1st way means code can be used twice, so it can break RFC6749.
> 2nd way means defining another code (ex. code_for_backend etc.)
>=20
> Does someone has implementation supporting such use-case?
>=20
> =E2=80=94
> nov
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth