Subject: [OAUTH-WG] OAuth and IoT

From: Adam Lewis <[email-masked]>
Date: Fri, 2 Oct 2015 14:45:56 -0500

Hi all,

Looking to find some pointers to effort around usage of OAuth and IoT.
Will embedded devices / appliances use the client credential grant type?
This would seem to be a natural choice, now does every device have a unique
client id?  I am looking at use cases where we will have a large set of
devices without a UI acting on their own behalf (not the users) and will
need to obtain access tokens.  What are the best practices around this?  It
seems impractical to add every one of these devices as a unique client to
the OAuth server, but I'm unclear what the other options are given the
current set of drafts.

tx!
adam

---

From: Adam Lewis <[email-masked]>
Date: Fri, 2 Oct 2015 15:19:09 -0500

And on that similar note, has their been any work done around having a
singe client id, and registering that client id with the AS, but tying the
client id to a trust anchor instead of a single public key certificate,
such that any client issued a certificate by the trusted CA could obtain an
access token?  This would enable a single entry in the AS for each type of
client.

On Fri, Oct 2, 2015 at 2:45 PM, Adam Lewis <[email-masked]
> wrote:

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 2 Oct 2015 16:35:15 -0400

Adam,

Are you following the ACE working group?  They are wrapping up their use case document and IETF last call should start next week.  OAuth is being considered and they will be busy with suction work soon for Authentication and authorization in Constrained Environments.

I'd suggest start with a read of the use case draft.  The actors draft will follow through soon with a WGLC (I hope).  They should be discussing solutions in Yokohama.

Kathleen 

Sent from my iPhone

> On Oct 2, 2015, at 4:19 PM, Adam Lewis <[email-masked]> wrote:
> 
> And on that similar note, has their been any work done around having a singe client id, and registering that client id with the AS, but tying the client id to a trust anchor instead of a single public key certificate, such that any client issued a certificate by the trusted CA could obtain an access token?  This would enable a single entry in the AS for each type of client.  
> 
>> On Fri, Oct 2, 2015 at 2:45 PM, Adam Lewis <[email-masked]> wrote:
>> Hi all,
>> 
>> Looking to find some pointers to effort around usage of OAuth and IoT.  Will embedded devices / appliances use the client credential grant type?  This would seem to be a natural choice, now does every device have a unique client id?  I am looking at use cases where we will have a large set of devices without a UI acting on their own behalf (not the users) and will need to obtain access tokens.  What are the best practices around this?  It seems impractical to add every one of these devices as a unique client to the OAuth server, but I'm unclear what the other options are given the current set of drafts. 
>> 
>> 
>> 
>> tx!
>> adam
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Adam Lewis <[email-masked]>
Date: Fri, 2 Oct 2015 15:36:26 -0500

Thank you Kathleen, exactly the type of pointers I was looking for.  Will
head over their now :-)

On Fri, Oct 2, 2015 at 3:35 PM, Kathleen Moriarty <
[email-masked]> wrote:

> Adam,
>
> Are you following the ACE working group?  They are wrapping up their use
> case document and IETF last call should start next week.  OAuth is being
> considered and they will be busy with suction work soon for Authentication
> and authorization in Constrained Environments.
>
> I'd suggest start with a read of the use case draft.  The actors draft
> will follow through soon with a WGLC (I hope).  They should be discussing
> solutions in Yokohama.
>
> Kathleen
>
> Sent from my iPhone
>
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_oauth&d=AwMFaQ&c=q3cDpHe1hF8lXU5EFjNM_A&r=hS3A5qzQnW1hxYBhPrxNW10ESeDiiiRwR8H84JHIXTI&m=GxAwMcetDxaO8Tzd99LARZeZhw6NR0xA8wT06EFOJJA&s=es9C9muLLeu4OOIrHMqVkuC0Hhd9Wx8RPgDVD_sL5w0&e=>
>
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 2 Oct 2015 16:42:14 -0400

No problem and I guess autocorrect had ideas of its own in my message.

s/suction/solution/

Sent from my iPhone

> On Oct 2, 2015, at 4:36 PM, Adam Lewis <[email-masked]> wrote:
> 
> Thank you Kathleen, exactly the type of pointers I was looking for.  Will head over their now :-)
> 
>> On Fri, Oct 2, 2015 at 3:35 PM, Kathleen Moriarty <[email-masked]> wrote:
>> Adam,
>>