Subject: [OAUTH-WG] Fwd: [oauth] Good list of OAuth open source?

From: Eve Maler <[email-masked]>
Date: Fri, 24 Jun 2011 10:02:25 -0700

Zero response from the other list. Any suggestions from folks here?

Begin forwarded message:

> From: Eve Maler <[email-masked]>
> Date: 20 June 2011 4:54:56 PM PDT
> To: [email-masked]
> Subject: [oauth] Good list of OAuth open source?
> Reply-To: [email-masked]
> 
> The list at http://oauth.net/code/ seems really random and out of date. Does anyone have a current list of open-source software that supports OAuth, including drafts of 2.0?
> 
> Thanks,
> 
> 	Eve

Eve Maler                                  http://www.xmlgrrl.com/blog
+1 425 345 6756                         http://www.twitter.com/xmlgrrl

---

From: David Recordon <[email-masked]>
Date: Fri, 24 Jun 2011 10:07:29 -0700

I was trying to keep http://wiki.oauth.net/w/page/25236487/OAuth-2 up
to date but haven't in awhile.

On Fri, Jun 24, 2011 at 10:02 AM, Eve Maler <[email-masked]> wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Fri, 24 Jun 2011 10:09:09 -0700

oauth.net needs some love but I don't have the time. If anyone is interested in working on it, please contact me and I'll get you setup.

EHL

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Eve Maler
> Sent: Friday, June 24, 2011 10:02 AM
> To: oauth WG
> Subject: [OAUTH-WG] Fwd: [oauth] Good list of OAuth open source?
> 
> > The list at http://oauth.net/code/ seems really random and out of date.
> Does anyone have a current list of open-source software that supports
> OAuth, including drafts of 2.0?
> >
> > Thanks,
> >
> > 	Eve
> 
>

---

From: Maciej Machulak <[email-masked]>
Date: Fri, 24 Jun 2011 18:09:39 +0100

I haven't seen such a list but it would be great to update the
existing one on oauth.net. There's the Apache Amber project [1] which
is the OAuth 2.0 implementation in Java used quite a lot. Could anyone
include it in the list, please?

Thank you in advance.

Cheers,
Maciej

[1] http://incubator.apache.org/projects/amber.html

-- 
Maciej Machulak
email: [email-masked]
tel: +48 602 45 31 44
tel: +44 7999 606 767

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Fri, 24 Jun 2011 10:16:07 -0700

On the subject of OAuth 2.0 libraries...

Why would you need a library?? Seems to be much less work to just make the HTTP requests directly. And if you are using MAC, you need a MAC library, not an OAuth 2.0...

EHL

> Of David Recordon
> Sent: Friday, June 24, 2011 10:07 AM
> To: Eve Maler
> Cc: oauth WG
> Subject: Re: [OAUTH-WG] Fwd: [oauth] Good list of OAuth open source?
> 
> I was trying to keep http://wiki.oauth.net/w/page/25236487/OAuth-2 up to
> date but haven't in awhile.
> 
>

---

From: Maciej Machulak <[email-masked]>
Date: Fri, 24 Jun 2011 18:23:30 +0100

These are not only client libraries, they work for AS and RS too.

Cheers,
Maciej

---

From: Justin Richer <[email-masked]>
Date: Fri, 24 Jun 2011 14:11:31 -0400

Eve,

We've been using (and contributing some to) the implementation in
SpringSecurity:

  http://static.springsource.org/spring-security/oauth/

I don't have a good list otherwise, though I'd be interested in seeing
the results as well.

To Eran: I really don't get your comment. Libraries are a very Good
Thing and their use and development should be greatly encouraged by the
OAuth community. The less that I have to write the Same Code As Last
Time the better. 

 -- Justin

---

From: Marius Scurtescu <[email-masked]>
Date: Fri, 24 Jun 2011 11:46:02 -0700

> OAuth community. The less that I have to write the Same Code As Last

+1

If you look at code that is not using a library you will notice that
it is full of random validation, repeated all over the place. Also,
you would be surprised how many developers decide to parse JSON
responses manually, just by splitting on { : and ,

Marius

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Fri, 24 Jun 2011 11:59:59 -0700

Libraries are no cure for stupidity.

On the client side, you make two simple HTTP requests. The facilities to make these requests should be available and easy to use. Parsing JSON responses should be part of any modern web platform. The part that might need more work is handling of refresh tokens, storing credentials, and setting up the redirection endpoint. But these tend to be to application specific for a library to offer much value (unless it is a highly specific environment).

My point is that OAuth 2.0 was explicitly designed to work without a library on the client side, and it would actually be better if people building web services using OAuth as a client understood what they are doing and how the protocol works.

My entire Facebook OAuth login code in node.js is about 30 lines, and that includes all the event handlers for the HTTP client calls. It is actually shorter than my Twitter OAuth code which uses an OAuth 1.0 library.

What does add tremendous value is offering a service-specific SDK. In that context, OAuth is just a tiny detail.

EHL

> Of Marius Scurtescu
> Sent: Friday, June 24, 2011 11:46 AM
> To: Justin Richer
> Cc: oauth WG
> > Thing and their use and development should be greatly encouraged by
> > the OAuth community. The less that I have to write the Same Code As
> > Last Time the better.
> 
> +1
> 
> If you look at code that is not using a library you will notice that it is full of
> random validation, repeated all over the place. Also, you would be surprised
> how many developers decide to parse JSON responses manually, just by
> splitting on { : and ,
> 
> Marius

---

From: Teo Hui Ming <[email-masked]>
Date: Sat, 25 Jun 2011 04:48:56 +0800

Hi, I notice most open source OAuth2 client/server libraries
implementation is only up to draft 10.

Here's a quick raw list in case you interested:
https://github.com/teohm/teohm.github.com/wiki/OAuth

Anyone knows if there is an open source OAuth2 server reference
implementation that reflects the latest draft 16, and unit-tested
against the security considerations in section 10?

-- 
Teo Hui Ming

---

From: Eve Maler <[email-masked]>
Date: Fri, 24 Jun 2011 14:19:09 -0700

Thanks, y'all, for the responses. I've heard from others that a library can end up taking more time to figure out than just coding it fresh because the latter is just that simple, but I suspect this is a YMMV kind of thing. And it seems there's universal agreement that a MAC library would be a very good idea regardless.

	Eve

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Fri, 24 Jun 2011 14:24:09 -0700

I maintain the node.js 'mac' module:

https://github.com/hueniverse/node-mac
or 'npm install mac'

A browser JS lib is available at:

https://sled.com/scripts/mac.js

Both are used in production.

EHL

> Sent: Friday, June 24, 2011 2:19 PM
> To: oauth WG
> Thanks, y'all, for the responses. I've heard from others that a library can end
> up taking more time to figure out than just coding it fresh because the latter
> is just that simple, but I suspect this is a YMMV kind of thing. And it seems
> there's universal agreement that a MAC library would be a very good idea
> regardless.
> 
> 	Eve
>

---

From: Phil Hunt <[email-masked]>
Date: Fri, 24 Jun 2011 14:34:14 -0700

Eve,

Were you just asking about client libraries?  Or did you mean some open source for things like building authorization/token/resource service end-points?

Phil

@independentid
www.independentid.com
[email-masked]

---

From: "matake@gmail" <[email-masked]>
Date: Sat, 25 Jun 2011 09:17:21 +0900

Hi,

I maintain Ruby OAuth2 server library.
https://github.com/nov/rack-oauth2

And sample servers on Heroku
http://rack-oauth2-sample.heroku.com/ (Bearer)
http://rack-oauth2-sample-mac.heroku.com/ (MAC)

I'm trying to keep them up to date, not exactly sure it's 100% following draft 16 though.

---

From: Eve Maler <[email-masked]>
Date: Fri, 24 Jun 2011 20:23:38 -0700

I'm interested in learning about all of the above (uh, below).

	Eve

---

From: Teo Hui Ming <[email-masked]>
Date: Sat, 25 Jun 2011 17:25:47 +0800

Thanks for sharing, the code looks pretty neat!

-- 
Teo Hui Ming

---

From: Andrew Arnott <[email-masked]>
Date: Sat, 25 Jun 2011 21:46:29 -0700

DotNetOpenAuth (http://www.dotnetopenauth.net/) implements all 3 roles to
draft 16, but it isn't considered finished (at least till the spec is).  In
particular, while the happy path is pretty well done, error reporting is not
there much at all yet (mostly because that's been a turbulent area of the
spec among recent drafts).

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death
your right to say it." - S. G. Tallentyre

On Sat, Jun 25, 2011 at 2:25 AM, Teo Hui Ming <[email-masked]> wrote:

> >>>> The list at http://oauth.net/code/ seems really random and out of
> date. Does anyone have a current list of open-source software that supports