Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token

Inline.

On 2012-04-13, at 9:13 PM, Lewis Adam-CAL022 wrote:

> Hi Justin …
>  
> In your application, to start things off, you fire off a web browser to the authorization server's authorization endpoint. The user logs in to the authorization server through the web browser, approves this copy of your app, and gets redirected to "myapp://oauthcallback?code=basdf132". Your app grabs the "myapp://" url and plucks the authorization code off the end of it. Your app then takes that code and sends it in the background to the token endpoint to exchange for a token.
>  
> <acl> this is the part I’m missing.  I understand how to get the authorization code to the client …  I think what you’re saying is that when the client present the access code to the token endpoint, that the token endpoint can return either a SAML or JWT token? 

Yes this is returned as a bearer token in OAuth speak, but the contents can be JWT or SAML.

> Is the token endpoint typically part of the Authorization Server?  Is the type of token returned (SAML/JWT/etc) depending on the implementation and what is supported by different vendors and open source, or is this required by the standard?

The Token endpoint is part of the Authorization server.

The format of the authorization and refresh tokens are not defined in the OAuth 2.0 spec, other than to treat them as opaque to the client.

>   OAuth 2.0 doesn’t really say a whole lot about the actual access token.  Is this all considered out of band from OAuth and a matter of implementation?

Yes,  some implementations send SAML tokens to the resource server, some JWT, and probably most send a proprietary or opaque token to the resource server which then calls back to a STS like service to introspect the token.

I know Justin has introspection endpoint as part of the MITRE openID connect implementation.   Ping also uses a similar one by default but can also use structured tokens.

>   Btw … I currently have two OAuth implementations running in the lab … an evaluation copy of PingFederate and an open source stack (OpenAM). </acl>

I am with one of the ForgeRock people tomorrow so I will check on what they are using for access tokens.

Both implementations will probably work for what you are trying to do.  I can't speculate on which is best for you at this point.

Regards
John B.

> 
>  
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth