Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token

Lewis Adam-CAL022 <Adam.Lewis@motorolasolutions.com> Fri, 13 April 2012 19:13 UTC

Received-SPF: pass (mail72-am1: domain of motorolasolutions.com designates 129.188.136.17 as permitted sender) client-ip=129.188.136.17; envelope-from=Adam.Lewis@motorolasolutions.com; helo=il06msg01.mot-solutions.com ; olutions.com ;
From: Lewis Adam-CAL022 <Adam.Lewis@motorolasolutions.com>
To: Justin Richer <jricher@mitre.org>
Thread-Topic: [OAUTH-WG] Using OAuth to get a JWT/SAML token
Thread-Index: AQHNGZQHGnbSav9o6k2Y2ikZeKN005aZHXKw
Date: Fri, 13 Apr 2012 19:13:18 +0000
Message-ID: <59E470B10C4630419ED717AC79FCF9A90741A7@BL2PRD0410MB363.namprd04.prod.outlook.com>
References: <59E470B10C4630419ED717AC79FCF9A906E74E@CH1PRD0410MB369.namprd04.prod.outlook.com> <4F885680.5090801@mitre.org>
In-Reply-To: <4F885680.5090801@mitre.org>
Accept-Language: en-US
Content-Language: en-US
Content-Type: multipart/alternative; boundary="_000_59E470B10C4630419ED717AC79FCF9A90741A7BL2PRD0410MB363na_"
MIME-Version: 1.0
X-MS-Exchange-CrossPremises-AuthMechanism: 04
X-MS-Exchange-CrossPremises-AuthSource: BL2PRD0410HT003.namprd04.prod.outlook.com
X-MS-Exchange-CrossPremises-SCL: -1
X-MS-Exchange-CrossPremises-messagesource: StoreDriver
X-MS-Exchange-CrossPremises-BCC:
X-MS-Exchange-CrossPremises-rules-execution-history: Sample Spam Submissions
X-MS-Exchange-CrossPremises-processed-by-journaling: Journal Agent
X-MS-Exchange-CrossPremises-ContentConversionOptions: False;00160000;True;;
X-OrganizationHeadersPreserved: BL2PRD0410HT003.namprd04.prod.outlook.com
X-FOPE-CONNECTOR: Id%0$Dn%*$RO%0$TLS%0$FQDN%$TlsDn%
X-FOPE-CONNECTOR: Id%1294$Dn%MITRE.ORG$RO%2$TLS%3$FQDN%msgate.mot-solutions.com$TlsDn%
X-FOPE-CONNECTOR: Id%1294$Dn%IETF.ORG$RO%2$TLS%3$FQDN%msgate.mot-solutions.com$TlsDn%
X-CFilter-Loop: Reflected
X-OriginatorOrg: motorolasolutions.com
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 13 Apr 2012 19:13:35 -0000

Hi Justin ...

In your application, to start things off, you fire off a web browser to the authorization server's authorization endpoint. The user logs in to the authorization server through the web browser, approves this copy of your app, and gets redirected to "myapp://oauthcallback?code=basdf132". Your app grabs the "myapp://" url and plucks the authorization code off the end of it. Your app then takes that code and sends it in the background to the token endpoint to exchange for a token.

<acl> this is the part I'm missing.  I understand how to get the authorization code to the client ...  I think what you're saying is that when the client present the access code to the token endpoint, that the token endpoint can return either a SAML or JWT token?  Is the token endpoint typically part of the Authorization Server?  Is the type of token returned (SAML/JWT/etc) depending on the implementation and what is supported by different vendors and open source, or is this required by the standard?  OAuth 2.0 doesn't really say a whole lot about the actual access token.  Is this all considered out of band from OAuth and a matter of implementation?  Btw ... I currently have two OAuth implementations running in the lab ... an evaluation copy of PingFederate and an open source stack (OpenAM). </acl>

[OAUTH-WG] Using OAuth to get a JWT/SAML token Lewis Adam-CAL022
Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token Justin Richer
Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token Lewis Adam-CAL022
Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token John Bradley
Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token Lewis Adam-CAL022
Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token Paul Madsen
Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token Brian Campbell
Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token Lewis Adam-CAL022
Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token Lewis Adam-CAL022
Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token John Bradley
Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token William Mills
Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token Brian Campbell
Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token Paul Madsen
Re: [OAUTH-WG] Using OAuth to get a JWT/SAML token Justin Richer