Subject: [OAUTH-WG] Grant Type to Login via another Provider's OAuth Token

From: Spencer MacDonald <[email-masked]>
Date: Sun, 12 Apr 2015 14:29:16 +0100

Hi,

I wondered if there was a best practise/standard/extension grant type for
exchanging an OAuth Token from another provider (instead of a username and
password) for an OAuth Token.

The situation I am facing is that I am developing a native iOS application
that makes use of the Facebook Graph API, whereby I fetch an OAuth Token
using their native SDK on the device. I then want to login exchange their
Facebook OAuth Token with my server (the OAuth Token is then used on the
server to process data) in exchange for an OAuth Token to communicate with
my server.

Is there a best practise for this approach?

Regards

Spencer

---

From: Nat Sakimura <[email-masked]>
Date: Mon, 13 Apr 2015 01:16:50 +0900

the best practice to log the user in general is to use IpenID Connect.

For Facebook specifically, there is a closely related spec called signed
request.

You cannot just use a regular access token to log a user in. It's too
dangerous.

Nat via iPhone

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en

---

From: Justin Richer <[email-masked]>
Date: Sun, 12 Apr 2015 11:41:10 -0500

You can’t rely on the presence of an access token to log a user in. Some more information is available here:

http://oauth.net/articles/authentication/ <http://oauth.net/articles/authentication/>

However, if you want to bridge authorization based on an external token and you’re willing to do some validation of that token, you can use something like the draft token chaining mechanism defined here:

https://tools.ietf.org/html/draft-richer-oauth-chain-00 <https://tools.ietf.org/html/draft-richer-oauth-chain-00>

For this, your AS will basically take in a Facebook token, validate it, and spit out a domain-local token.

This doesn’t, however, tell you much about someone being “logged in” from Facebook, just means you’ve got an authorized application. Again, see the oauth.net <http://oauth.net/> article for more details on common pitfalls.

A standards-based way to do login is to use the OpenID Connect ID Token.

 — Justin

> On Apr 12, 2015, at 8:29 AM, Spencer MacDonald <[email-masked]> wrote:
> 
> Hi,
> 
> I wondered if there was a best practise/standard/extension grant type for exchanging an OAuth Token from another provider (instead of a username and password) for an OAuth Token.
> 
> The situation I am facing is that I am developing a native iOS application that makes use of the Facebook Graph API, whereby I fetch an OAuth Token using their native SDK on the device. I then want to login exchange their Facebook OAuth Token with my server (the OAuth Token is then used on the server to process data) in exchange for an OAuth Token to communicate with my server.
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth