Subject: [OAUTH-WG] Using Oauth2 token to SOAP web services

From: Grant Yang <[email-masked]>
Date: Wed, 14 Mar 2012 22:41:23 -0700 (PDT)

Hi all, 

We were discussing the possibility to use Oauth2 token on SOAP in our product. 

The preferred way in mentioned in RFC is of course to put it to HTTP Authorization header, but in this case it will beyond the scope of SOAP stack and I am not sure it shall be the correct way to go. It is also recognized that there is some implementation (such as salesforce) is using some SOAP header (“sessionId”) to put this token, but it looks like a private implementation and I did not find any specification supporting it. 

Could any experts here illustrate any organization or forum is working on using Oauth2 token for SOAP request? As there are quite some legacy SOAP based web services, hopefully it is a question makes sense for you as well.

Thoughts?

Grant Yang

Architect, SDP of ORACLE Communications

---

From: Grant Yang <[email-masked]>
Date: Sun, 18 Mar 2012 21:15:45 -0700 (PDT)

Thank you very much Phil! 

The thing is, the Oauth spec just mentioned putting the Access Token into HTTP header “Authorization”. I don’t think it applies to SOAP as this header is not visible from SOAP stack perspective.

So, when we talking about the soap header, are we talking about the header used by WS-Security? Could you please be kindly providing me one example on putting the Access Token into SOAP header and let me know which product is currently using this mechanism? 

Thanks a lot,
Grant.

From: Phil Hunt 
Sent: Thursday, March 15, 2012 11:53 PM
To: Grant Yang
Subject: Re: [OAUTH-WG] Using Oauth2 token to SOAP web services

Grant,

You put it in the soap header of course in the same spot as any other credential.  :-)

Phil

@independentid

HYPERLINK "http://www.independentid.com"www.independentid.com

HYPERLINK "mailto:[email-masked]"[email-masked]

On 2012-03-14, at 10:41 PM, Grant Yang wrote:

Hi all,

Thoughts?

Grant Yang

_______________________________________________
OAuth mailing list
HYPERLINK "mailto:[email-masked]"[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 19 Mar 2012 09:05:41 +0200

Hi Grant, 

IMHO the main reason why the OAuth specification does not standardize OAuth usage specially for SOAP is because most people by now realized that SOAP, as another layer of encapsulation, does not add a lot of value. 

Ciao
Hannes

On Mar 19, 2012, at 6:15 AM, Grant Yang wrote:

> www.independentid.com
> [email-masked]
> [email-masked]
> [email-masked]

---

From: Phil Hunt <[email-masked]>
Date: Mon, 19 Mar 2012 06:23:50 -0700

There's going to be a lot of mixed environments for some time. Particularly an issue at the boundaries between classic soap services and new restful services.  

Phil

---

From: Paul Madsen <[email-masked]>
Date: Mon, 19 Mar 2012 09:29:02 -0400

mixed REST & SOAP environments dont necessarily require using OAuth 
tokens directly in SOAP headers  - you can exchange the token for an 
equivalent SAML assertion (for which we already have a profile 
stipulating how to use in SOAP headers)

We see alot of this - people leveraging existing SOAP backends but 
opening up REST APIs to partners & mobile

On 3/19/12 9:23 AM, Phil Hunt wrote:
> On 2012-03-19, at 0:05, Hannes Tschofenig<[email-masked]>  wrote:
>
>> Hi Grant,
>>

---

From: Igor Faynberg <[email-masked]>
Date: Mon, 19 Mar 2012 14:11:53 -0400

Phil is right!  I observe the same thing: the frond-end is RESTful; the 
back-end is mixed.  Personally, I think it would be good for OAuth to be 
deployed as wide as possible.  (The SAML/OAuth  ideas I think are 
working the same problem.)

Igor