Subject: [OAUTH-WG] is OAuth protocol based on HTTP？

From: dgq2011 <[email-masked]>
Date: Wed, 14 Nov 2012 22:51:27 +0800

Hi, all! It is said in RFC 6749 (The OAuth 2.0 Authorization Framework) that “this specification is designed for use with HTTP ([RFC2616])” and “The use of OAuth over any protocol other than HTTP is out of scope.” Do those statements mean that the communication between any two roles in OAuth protocol (namely resource owner, resource server, client and authorization server) is based on HTTP protocol? I am not familiar with the OAuth protocol and just would like to confirm this question. Any response is appreciated!

Best wishes！
Guangqing Deng

dgq2011

---

From: Justin Richer <[email-masked]>
Date: Wed, 14 Nov 2012 10:02:56 -0500

That's correct, the OAuth protocol is only defined over HTTP. This 
constitutes the overwhelming majority of use cases, and the specifics of 
HTTP operation are central to the assumptions made in OAuth's design. 
While it's plausible that the interactions between the parties could 
take place over some other protocol, this is outside the scope of the 
core definition, and such use is considered an extension. For instance, 
there's a method for presenting an OAuth bearer token over SASL:

   http://tools.ietf.org/html/draft-ietf-kitten-sasl-oauth

This extension doesn't define a method of getting a token, but it does 
define a method of presenting a token over a non-HTTP protocol.

Hope this helps,
  -- Justin

On 11/14/2012 09:51 AM, dgq2011 wrote:
>
> Hi, all! It is said in RFC 6749 (The OAuth 2.0 Authorization 
> Framework) that “this specification is designed for use with HTTP 
> ([RFC2616])” and “The use of OAuth over any protocol other than HTTP 
> is out of scope.” Do those statements mean that the communication 
> between any two roles in OAuth protocol (namely resource owner, 
> resource server, client and authorization server) is based on HTTP 
> protocol? I am not familiar with the OAuth protocol and just would 
> like to confirm this question. Any response is appreciated!
>
> Best wishes！
> Guangqing Deng
> ------------------------------------------------------------------------
> dgq2011
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 14 Nov 2012 10:09:55 -0500

Hi Guangqing, 

RFC 6749 should have explained this a bit more. 

RFC 6749 uses HTTPS to interact with an authorization server to obtain access tokens (among other things). RFC 4749 does, however, not specify what protocol is used to present these access tokens to a resource server. RFC 6750 explains how this is done for resource servers that use HTTP. There is, however, also ongoing work to provide OAuth support for non-HTTP-based protocol, see http://tools.ietf.org/html/draft-ietf-kitten-sasl-oauth-08. SASL and the GSS-API is used for integrating OAuth into a range of protocols. 

Ciao
Hannes

---

From: Lewis Adam-CAL022 <[email-masked]>
Date: Wed, 14 Nov 2012 15:19:51 +0000

Hi Guangqing,

Just to build on what Justin and Hannes said, I have use cases that involve sending OAuth access tokens over MANY non-HTTP protocols including SIP, RTSP, SOAP (though you could argue that it is HTTP underneath), and other proprietary protocols. (I also have use cases for the more conventional RESTful API access as well.) The way my clients get the token (as Hannes mentioned) is always done over HTTPS between the client and RS.  

-adam

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
Sent: Wednesday, November 14, 2012 9:10 AM
To: dgq2011
Cc: [email-masked]
Subject: Re: [OAUTH-WG] is OAuth protocol based on HTTP？

Hi Guangqing, 

Ciao
Hannes