Subject: [OAUTH-WG] Issue token for another user

From: David Fox <[email-masked]>
Date: Sun, 11 Mar 2012 21:10:58 -0500

http://tools.ietf.org/html/draft-zeltsan-oauth-use-cases-02#section-3.8

In order to achieve the use case above, how would the client (a.k.a the 
resource owner in this case) specify which user to authorize?

Would the correct approach be to make a request to the Authorization 
Server with the grant type set to "client_credentials" and set the scope 
to user=user_id (where user_id would be the identifier for the user Bob)?

-David
<http://tools.ietf.org/html/draft-zeltsan-oauth-use-cases-02#section-3.8>

---

From: Shane B Weeden <[email-masked]>
Date: Mon, 12 Mar 2012 13:46:18 +1000

IMO the scenario as documented doesn't make complete sense in the context
of OAuth 2.0 as it says that Bob uses the access token to access Alice's
photos. Clients in OAuth 2.0 are not people, they are programs.

From:	David Fox <[email-masked]>
To:	"'OAuth WG'" <[email-masked]>
Date:	12/03/2012 12:15 PM
Subject:	[OAUTH-WG] Issue token for another user
Sent by:	[email-masked]

Would the correct approach be to make a request to the Authorization Server
with the grant type set to "client_credentials" and set the scope to
user=user_id (where user_id would be the identifier for the user Bob)?

-David
_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: William Mills <[email-masked]>
Date: Sun, 11 Mar 2012 21:28:55 -0700 (PDT)

Can you specify the user being accesses as the resource in the URL?

P.S. Please start using the http://twiki.corp.yahoo.com/view/Paranoidyahoos/SecurityRequest  for new requests like product and feature  reviews.

>________________________________
>To: 'OAuth WG' <[email-masked]> 
>Sent: Sunday, March 11, 2012 7:10 PM
>In order to achieve the use case above, how would the client (a.k.a
    the resource owner in this case) specify which user to authorize?
>Would the correct approach be to make a request to the Authorization
    Server with the grant type set to "client_credentials" and set the
    scope to user=user_id (where user_id would be the identifier for the
    user Bob)?

---

From: David Fox <[email-masked]>
Date: Sun, 11 Mar 2012 23:47:10 -0500

@Shane: Good point, and in my application the user/client would be 
authorizing another registered program. Was just using Bob to keep with 
the example.

@William:
1. I'm just building the API now so anything is possible, but could you 
give me an example of what you mean?
2. Sure will do, though, if that is a website, I'm not able to connect 
to it.

On 3/11/2012 23:28, William Mills wrote:
> P.S. Please start using the 
> http://twiki.corp.yahoo.com/view/Paranoidyahoos/SecurityRequest  for 
> new requests like product and feature  reviews.
>
>     ------------------------------------------------------------------------
>     *From:* David Fox <[email-masked]>
>     *To:* 'OAuth WG' <[email-masked]>
>     *Sent:* Sunday, March 11, 2012 7:10 PM
>     *Subject:* [OAUTH-WG] Issue token for another user
>
>     In order to achieve the use case above, how would the client
>     (a.k.a the resource owner in this case) specify which user to
>     authorize?
>
>     Would the correct approach be to make a request to the
>     Authorization Server with the grant type set to
>     "client_credentials" and set the scope to user=user_id (where
>     user_id would be the identifier for the user Bob)?
>
>     -David
>
>     [email-masked] <mailto:[email-masked]>

---

From: William Mills <[email-masked]>
Date: Sun, 11 Mar 2012 22:10:04 -0700 (PDT)

So Bob has already issued credentials to App-A and now needs to authorize App-B?

>To: William Mills <[email-masked]> 
>Cc: 'OAuth WG' <[email-masked]>; [email-masked] 
>Sent: Sunday, March 11, 2012 9:47 PM
>Subject: Re: [OAUTH-WG] Issue token for another user
> 
>
>@Shane: Good point, and in my application the user/client would be authorizing another registered program. Was just using Bob to keep with the example.
>
>@William:
>1. I'm just building the API now so anything is possible, but could
    you give me an example of what you mean?
>2. Sure will do, though, if that is a website, I'm not able to
    connect to it.
>>>In order to achieve the use case above, how would
                    the client (a.k.a the resource owner in this case)
                    specify which user to authorize?
>>>
>>>Would the correct approach be to make a request to
                    the Authorization Server with the grant type set to
                    "client_credentials" and set the scope to
                    user=user_id (where user_id would be the identifier
                    for the user Bob)?

---

From: David Fox <[email-masked]>
Date: Mon, 12 Mar 2012 00:23:57 -0500

More like, Bill (client/resource owner) wants to authorize and generate 
a token for App-B.

On 3/12/2012 00:10, William Mills wrote:
>     *To:* William Mills <[email-masked]>
>     *Cc:* 'OAuth WG' <[email-masked]>; [email-masked]
>     *Sent:* Sunday, March 11, 2012 9:47 PM
>     *Subject:* Re: [OAUTH-WG] Issue token for another user
>
>     authorizing another registered program. Was just using Bob to keep
>     with the example.
>
>     @William:
>     1. I'm just building the API now so anything is possible, but
>     could you give me an example of what you mean?
>>     http://twiki.corp.yahoo.com/view/Paranoidyahoos/SecurityRequest 
>>     for new requests like product and feature  reviews.
>>
>>         <mailto:[email-masked]>
>>         *To:* 'OAuth WG' <[email-masked]> <mailto:[email-masked]>

---

From: Eve Maler <[email-masked]>
Date: Sun, 11 Mar 2012 22:43:01 -0700

As written in the I-D, the use case does call for person-to-person sharing, which OAuth in its current state doesn't really cover. If you do want to achieve that outcome, User-Managed Access, built on top of OAuth, specializes in it. You can find out more at http://kantarainitiative.org/confluence/display/uma/Home . (We're holding a Twitter #umachat this Wednesday 9-10am PT if you want to deep-dive on UMA one tweet at a time.)

	Eve

On 11 Mar 2012, at 7:10 PM, David Fox wrote:

> In order to achieve the use case above, how would the client (a.k.a the resource owner in this case) specify which user to authorize?
> 
> Would the correct approach be to make a request to the Authorization Server with the grant type set to "client_credentials" and set the scope to user=user_id (where user_id would be the identifier for the user Bob)?
> 
> -David

Eve Maler                                  http://www.xmlgrrl.com/blog
+1 425 345 6756                         http://www.twitter.com/xmlgrrl

---

From: David Fox <[email-masked]>
Date: Mon, 12 Mar 2012 02:04:40 -0500

This looks identical to what I want to do, i'll definitely hop on the 
tweet chat.

Also, do you know of any good resources touching on how to implement this?

Thanks :)

On 3/12/2012 00:43, Eve Maler wrote:
> As written in the I-D, the use case does call for person-to-person 
> sharing, which OAuth in its current state doesn't really cover. If you 
> do want to achieve that outcome, User-Managed Access, built on top of 
> OAuth, specializes in it. You can find out more at 
> http://kantarainitiative.org/confluence/display/uma/Home . (We're 
> holding a Twitter #umachat this Wednesday 9-10am PT if you want to 
> deep-dive on UMA one tweet at a time.)
>
> Eve
>