Subject: [OAUTH-WG] Getting a username from an access id in oauth2

From: Brian Hurt <[email-masked]>
Date: Thu, 9 Apr 2015 13:35:47 -0400

This is probably the wrong place to ask this question- if so, I apologize.
But I'm trying to figure out how to get a username given only an access id
(and client id, etc.) in oauth2.  Is this possible, and if so, how?

Thanks,
Brian

---

From: Phil Hunt <[email-masked]>
Date: Thu, 9 Apr 2015 11:45:50 -0700

This has been a long standing issue. OAuth is an authorization protocol and not an authentication protocol. 

You might want to look at OpenID Connect for an OAuth profile that addresses your case. 

Phil

> On Apr 9, 2015, at 10:35, Brian Hurt <[email-masked]> wrote:
> 
> 
> This is probably the wrong place to ask this question- if so, I apologize.  But I'm trying to figure out how to get a username given only an access id (and client id, etc.) in oauth2.  Is this possible, and if so, how?
> 
> Thanks,
> Brian
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Josh Mandel <[email-masked]>
Date: Thu, 9 Apr 2015 11:46:20 -0700

Hi Brian,

In general, OAuth 2.0 is an authorization framework; as such it doesn't
directly describe authentication claims like "who is the current user?" or
"what is this user's e-mail address". OAuth 2.0 can be used as the basis
for authentication protocols like OpenID Connect [1], which you may want to
explore as a "complete package" that provides this kind of functionality.

Best,

  Josh

1. http://openid.net/specs/openid-connect-core-1_0.html

On Thu, Apr 9, 2015 at 10:35 AM, Brian Hurt <[email-masked]> wrote:

>
> This is probably the wrong place to ask this question- if so, I
> apologize.  But I'm trying to figure out how to get a username given only
> an access id (and client id, etc.) in oauth2.  Is this possible, and if so,
> how?
>
> Thanks,
> Brian
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 09 Apr 2015 20:49:19 +0200

Brian,

in addition to what Phil said let me provide you with two references:

* Article about user authentication and OAuth:
http://oauth.net/articles/authentication/

* OpenID Connect specification as a way to do what you seem to be
looking for:
http://openid.net/connect/

Ciao
Hannes

---

From: Hans Zandbelt <[email-masked]>
Date: Thu, 09 Apr 2015 23:44:27 +0100

without further context the original question may be about retrieving 
the username of the user on whose behalf the OAuth 2.0 client is acting, 
which is a valid question with a valid (introspection) answer in a pure 
OAuth 2.0 scenario

Hans.

-- 
Hans Zandbelt              | Sr. Technical Architect
[email-masked] | Ping Identity

---

From: Bill Mills <[email-masked]>
Date: Fri, 10 Apr 2015 08:21:24 +0000 (UTC)

Given only a user id or client the answer is no.  You'd want to use something like the old UNIX "finger".  If you have a valid OAuth user token then as someone already said the token introspection stuff *can* do exactly this, but what info you get out of it may vary. 

     On Thursday, April 9, 2015 10:38 AM, Brian Hurt <[email-masked]> wrote:

Thanks,Brian

---

From: Brian Hurt <[email-masked]>
Date: Fri, 10 Apr 2015 09:04:34 -0400

Yes.  I'm being handed the access id, client id, etc. of an oauth session,
but not the username.  So I was wondering if I was missing something
obvious, or that I really do need the user name passed in as well.  And
it's sounding like the latter.

Thanks, everyone, for your help.

Brian

On Thu, Apr 9, 2015 at 6:44 PM, Hans Zandbelt <[email-masked]>
wrote:

> without further context the original question may be about retrieving the
> username of the user on whose behalf the OAuth 2.0 client is acting, which
> is a valid question with a valid (introspection) answer in a pure OAuth 2.0
> scenario
>
> Hans.
>
>

---

From: Adam Lewis <[email-masked]>
Date: Fri, 10 Apr 2015 08:17:56 -0500

Hi Brian,

It can get confusing since OAuth doesn't define the contents/structure of
the access token the way OIDC did for the id_token.

Though to me it seems pretty obvious that in a delegated authorization
framework where "alice" delegated approval to "client" to access her
"protected resources" on a "resource server" that when "client" presents
the "access token" to the "resource server" the token would need to
indicate that it is "alice's" resources the token is good for, and not
"bob's"

Certainly in every implementation of OAuth that I've played with (at least
half a dozen) all the access tokens are able to communicate that the access
token is being used to access "alice's" resources.  But maybe that is what
the "access id" is in your implementation?  Maybe the access id points to
alice's resources?

We have actually profiled our access token to look just like the id_token,
with the RS being the audience instead of the client.  In fact if you
looked at our access token and look at a standard Id token you would have a
hard time telling them apart.

I've always argued that the RS as a relying party wants to know a lot of
the same things as a traditional RP (e.g. when did the user authenticate to
give you this access token (auth_time) and how did they authenticate it
(amr/acr)).  For access to high assurance protected resources, the RS might
want to know that the person who delegated their authorization proved their
identity to the AS using 2-factor authentication.  Granted, the AS could
also implement policy that would only return a scopes to the high assurance
protected resource if the user used 2 factor ... but I guess that why OAuth
is a "framework" because you can slice it half a dozen ways :-)

-adam