[woes] Native JWT support in Google App Engine

Eric Sachs <esachs@google.com> Wed, 06 April 2011 19:41 UTC

DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:date:message-id:subject:from:to:content-type; b=hCP1Y6jZLiIxRH/9RE1iPhX4KyQNPco5omABIaoyenSLdgSzOef0NDqcYLV0uw84WI wdmENUk7hEurnVEVfCNA==
MIME-Version: 1.0
Date: Wed, 06 Apr 2011 12:43:05 -0700
Message-ID: <BANLkTikAd0gbN2x8cWQQRZXwehugCE3tXw@mail.gmail.com>
From: Eric Sachs <esachs@google.com>
To: woes@ietf.org
Content-Type: multipart/alternative; boundary="90e6ba308c6a9a94d504a04533d6"
Subject: [woes] Native JWT support in Google App Engine
Precedence: list

Google has just added native support for JWT to Google App Engine.  Here is
the documentation:

https://sites.google.com/site/oauthgoog/authenticate-google-app-engine-app

Our hope is to work with other players in the cloud computing space to
improve some elements of cloud security by using PKI, JWT & OAuth2 for
interop between our systems.

Based on past industry discussion, we wroteup a description of some of the
general interop use-cases:

https://sites.google.com/site/oauthgoog/robotaccounts/cloudtoonpremise

 https://sites.google.com/site/oauthgoog/robotaccounts/onpremisetocloud

While this new feature in Google App Engine is a significant step for
Google, we realize there is more to do on our side such as adding support
for JWT assertions in our recently announced OAuth2 support for Google
APIs<http://googlecode.blogspot.com/2011/03/making-auth-easier-oauth-20-for-google.html>.
 However we would prefer to get feedback from this group on a standard
approach, including around key rotation/management.

Eric Sachs
Senior Product Manager, Internet Identity
Google

[woes] Native JWT support in Google App Engine Eric Sachs
Re: [woes] Native JWT support in Google App Engine Manger, James H
Re: [woes] Native JWT support in Google App Engine Jian