Subject: [OAUTH-WG] Call for adoption: OAuth 2.0 for Native Apps

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 19 Jan 2016 12:46:57 +0100

Hi all,

this is the call for adoption of OAuth 2.0 for Native Apps, see
http://datatracker.ietf.org/doc/draft-wdenniss-oauth-native-apps/

Please let us know by Feb 2nd whether you accept / object to the
adoption of this document as a starting point for work in the OAuth
working group.

Note: If you already stated your opinion at the IETF meeting in Yokohama
then you don't need to re-state your opinion, if you want.

The feedback at the Yokohama IETF meeting was the following: 16 persons
for doing the work / 0 persons against / 2 persons need more info

Ciao
Hannes & Derek

---

From: Anthony Nadalin <[email-masked]>
Date: Wed, 20 Jan 2016 09:50:54 +0000

After reading this draft I  think that this may be better off as an experimental draft and not a WG draft

-----Original Message-----
From: OAuth [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
Sent: Tuesday, January 19, 2016 3:47 AM
To: [email-masked]
Subject: [OAUTH-WG] Call for adoption: OAuth 2.0 for Native Apps

Hi all,

this is the call for adoption of OAuth 2.0 for Native Apps, see https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fdatatracker.ietf.org%2fdoc%2fdraft-wdenniss-oauth-native-apps%2f&data=01%7c01%7ctonynad%40microsoft.com%7c2180a2867ac74a039d6108d320c642c2%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=fT7bH5bT8ISndWGCaNj%2f4XGrCz1xFzr0cQdWmGUhk%2fs%3d

Please let us know by Feb 2nd whether you accept / object to the adoption of this document as a starting point for work in the OAuth working group.

Note: If you already stated your opinion at the IETF meeting in Yokohama then you don't need to re-state your opinion, if you want.

The feedback at the Yokohama IETF meeting was the following: 16 persons for doing the work / 0 persons against / 2 persons need more info

Ciao
Hannes & Derek

---

From: William Denniss <[email-masked]>
Date: Wed, 20 Jan 2016 23:23:56 +0800

Why is that Anthony? Do you have any concrete feedback?

I felt like we had pretty good consensus at IETF94 to proceed with
documenting this best practice.

On Wed, Jan 20, 2016 at 5:50 PM, Anthony Nadalin <[email-masked]>
wrote:

> https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fdatatracker.ietf.org%2fdoc%2fdraft-wdenniss-oauth-native-apps%2f&data=01%7c01%7ctonynad%40microsoft.com%7c2180a2867ac74a039d6108d320c642c2%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=fT7bH5bT8ISndWGCaNj%2f4XGrCz1xFzr0cQdWmGUhk%2fs%3d
>
> Please let us know by Feb 2nd whether you accept / object to the adoption
> of this document as a starting point for work in the OAuth working group.
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Justin Richer <[email-masked]>
Date: Wed, 20 Jan 2016 10:35:37 -0500

Tony, that doesn’t make sense. An experimental draft would still be a WG draft, and even then this doesn’t match any of the qualifications of “experimental” by IETF definition. It’s arguable whether it be marked “informational” or “standard” since it’s describing best practices more than protocols, but “experimental” doesn’t fit at all.

 — Justin

> On Jan 20, 2016, at 4:50 AM, Anthony Nadalin <[email-masked]> wrote:
>

---

From: Aaron Parecki <[email-masked]>
Date: Wed, 20 Jan 2016 07:40:23 -0800

The section on embedded web views doesn't mention the new iOS 9
SFSafariViewController which allows apps to display a system browser within
the application. The new API doesn't give the calling application access to
anything inside the browser, so it is acceptable for using with OAuth
flows. I think it's important to mention this new capability for apps to
leverage since it leads to a better user experience.

I'm sure that can be addressed in the coming months if this document is
just the starting point.

I definitely agree that a document about native apps is necessary since the
core leaves a lot of guessing room for an implementation.

For reference,
https://developer.apple.com/library/prerelease/ios/releasenotes/General/WhatsNewIniOS/Articles/iOS9.html#//apple_ref/doc/uid/TP40016198-DontLinkElementID_26

And see the attached screenshot for an example of what it looks like.

----
Aaron Parecki
aaronparecki.com
@aaronpk <http://twitter.com/aaronpk>

---

From: John Bradley <[email-masked]>
Date: Wed, 20 Jan 2016 14:45:15 -0300

Yes, in July we recommended using the system browser rather than WebViews.   

About that time Apple announced Safari view controller and Google Chrome custom tabs.   The code in the OS is now stable and we have done a fair amount of testing.

The OIDF will shortly be publishing reference libraries for iOS and Android to how how to best use View Controllers, and PKCE in native apps on those platforms.

We do need to update this doc to reflect what we have learned in the last 6 months.

One problem we do still have is not having someone with Win 10 mobile experience to help document the best practices for that platform. 
I don’t understand that platform well enough yet to include anything.

John B.

> On Jan 20, 2016, at 12:40 PM, Aaron Parecki <[email-masked]> wrote:
> 
> The section on embedded web views doesn't mention the new iOS 9 SFSafariViewController which allows apps to display a system browser within the application. The new API doesn't give the calling application access to anything inside the browser, so it is acceptable for using with OAuth flows. I think it's important to mention this new capability for apps to leverage since it leads to a better user experience.
> 
> I'm sure that can be addressed in the coming months if this document is just the starting point.
> 
> I definitely agree that a document about native apps is necessary since the core leaves a lot of guessing room for an implementation.
> 
> For reference, https://developer.apple.com/library/prerelease/ios/releasenotes/General/WhatsNewIniOS/Articles/iOS9.html#//apple_ref/doc/uid/TP40016198-DontLinkElementID_26 <https://developer.apple.com/library/prerelease/ios/releasenotes/General/WhatsNewIniOS/Articles/iOS9.html#//apple_ref/doc/uid/TP40016198-DontLinkElementID_26>
> 
> aaronparecki.com <http://aaronparecki.com/>
> On Tue, Jan 19, 2016 at 3:46 AM, Hannes Tschofenig <[email-masked] <mailto:[email-masked]>> wrote:
> Hi all,
> 
> http://datatracker.ietf.org/doc/draft-wdenniss-oauth-native-apps/ <http://datatracker.ietf.org/doc/draft-wdenniss-oauth-native-apps/>
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>
> 
>

---

From: Brian Campbell <[email-masked]>
Date: Wed, 20 Jan 2016 11:38:50 -0700

There is
https://tools.ietf.org/html/draft-wdenniss-oauth-native-apps-00#appendix-A
which has some mention of SFSafariViewController and Chrome Custom Tabs.

Maybe more is needed?

On Wed, Jan 20, 2016 at 10:45 AM, John Bradley <[email-masked]> wrote:

> About that time Apple announced Safari view controller and Google Chrome
> custom tabs.   The code in the OS is now stable and we have done a fair
> amount of testing.
>
> The OIDF will shortly be publishing reference libraries for iOS and
> Android to how how to best use View Controllers, and PKCE in native apps on
> those platforms.
>
> One problem we do still have is not having someone with Win 10 mobile
> experience to help document the best practices for that platform.
> I definitely agree that a document about native apps is necessary since
> the core leaves a lot of guessing room for an implementation.
>
> For reference,

---

From: Brian Campbell <[email-masked]>
Date: Wed, 20 Jan 2016 11:40:08 -0700

+1 for doing the work (I was remote for Yokohama so not sure if my feedback
was previously counted in that 16).

---

From: John Bradley <[email-masked]>
Date: Wed, 20 Jan 2016 16:41:07 -0300

Yes more is needed.   It was theoretical at that point.  Now we have implementation experience.

> On Jan 20, 2016, at 3:38 PM, Brian Campbell <[email-masked]> wrote:
> 
> There is https://tools.ietf.org/html/draft-wdenniss-oauth-native-apps-00#appendix-A <https://tools.ietf.org/html/draft-wdenniss-oauth-native-apps-00#appendix-A> which has some mention of SFSafariViewController and Chrome Custom Tabs. 
> 
> Maybe more is needed?
> 
> On Wed, Jan 20, 2016 at 10:45 AM, John Bradley <[email-masked] <mailto:[email-masked]>> wrote:
>> On Jan 20, 2016, at 12:40 PM, Aaron Parecki <[email-masked] <mailto:[email-masked]>> wrote:
>>

---

From: Nat Sakimura <[email-masked]>
Date: Thu, 21 Jan 2016 05:08:54 +0900

+1 for moving this forward.

2016年1月21日木曜日、John Bradley<[email-masked]>さんは書きました:

> On Jan 20, 2016, at 3:38 PM, Brian Campbell <[email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
>
> There is
> On Wed, Jan 20, 2016 at 10:45 AM, John Bradley <[email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
>
>> On Jan 20, 2016, at 12:40 PM, Aaron Parecki <[email-masked]
>> <javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
>>
>> [email-masked]
>> <javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
>>
>>> Hi all,
>>>
>>> [email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>
>> [email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>
>> [email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en

---

From: John Bradley <[email-masked]>
Date: Wed, 20 Jan 2016 17:10:56 -0300

PS as you probably suspected I am in favour of moving this forward.

> On Jan 20, 2016, at 5:08 PM, Nat Sakimura <[email-masked]> wrote:
> 
> 2016年1月21日木曜日、John Bradley<[email-masked] <mailto:[email-masked]>>さんは書きました:
>> On Jan 20, 2016, at 3:38 PM, Brian Campbell <[email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
>> 
>> On Wed, Jan 20, 2016 at 10:45 AM, John Bradley <[email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
>>> On Jan 20, 2016, at 12:40 PM, Aaron Parecki <[email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
>>> 
>>> On Tue, Jan 19, 2016 at 3:46 AM, Hannes Tschofenig <[email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
>>> Hi all,
>>> 
> http://nat.sakimura.org/ <http://nat.sakimura.org/>
> @_nat_en
>

---

From: Anthony Nadalin <[email-masked]>
Date: Thu, 21 Jan 2016 04:33:31 +0000

This work had many issues in the OpenID WG where it failed why should this be a WG item here ? The does meet the requirements for experimental, there is a fine line between informational and experimental, I would be OK with either but prefer experimental, I don’t think that this should become a standard.

From: OAuth [mailto:[email-masked]] On Behalf Of John Bradley
Sent: Wednesday, January 20, 2016 12:11 PM
To: Nat Sakimura <[email-masked]>
Cc: [email-masked]
Subject: Re: [OAUTH-WG] Call for adoption: OAuth 2.0 for Native Apps

On Jan 20, 2016, at 5:08 PM, Nat Sakimura <[email-masked]<mailto:[email-masked]>> wrote:

2016年1月21日木曜日、John Bradley<[email-masked]<mailto:[email-masked]>>さんは書きました:
Yes more is needed.   It was theoretical at that point.  Now we have implementation experience.

On Jan 20, 2016, at 3:38 PM, Brian Campbell <[email-masked]<javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:

There is https://tools.ietf.org/html/draft-wdenniss-oauth-native-apps-00#appendix-A<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-wdenniss-oauth-native-apps-00%23appendix-A&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=JWJmgLNPYe96GHUu67JZ1xdUN3T3c7kDNLQc8wniaDQ%3d> which has some mention of SFSafariViewController and Chrome Custom Tabs.
Maybe more is needed?

On Wed, Jan 20, 2016 at 10:45 AM, John Bradley <[email-masked]<javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
Yes, in July we recommended using the system browser rather than WebViews.

John B.

On Jan 20, 2016, at 12:40 PM, Aaron Parecki <[email-masked]<javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:

For reference, https://developer.apple.com/library/prerelease/ios/releasenotes/General/WhatsNewIniOS/Articles/iOS9.html#//apple_ref/doc/uid/TP40016198-DontLinkElementID_26<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fdeveloper.apple.com%2flibrary%2fprerelease%2fios%2freleasenotes%2fGeneral%2fWhatsNewIniOS%2fArticles%2fiOS9.html%23%2f%2fapple_ref%2fdoc%2fuid%2fTP40016198-DontLinkElementID_26&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=hQ6JGBJjX%2fwm36N6MpGeXbNQzwJaf6G6eyGxRVQH4ZA%3d>

----
Aaron Parecki
aaronparecki.com<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2faaronparecki.com%2f&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=S5aoD2X1pzBvy3qsEfPfyDCY0SQRqN7J6M%2fDLJz%2fUew%3d>
@aaronpk<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2ftwitter.com%2faaronpk&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=nEN2jz2zsIWlcJ%2bSWotUH8oLPFJ8ii4o49G0cEHYmQo%3d>

On Tue, Jan 19, 2016 at 3:46 AM, Hannes Tschofenig <[email-masked]<javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
Hi all,

this is the call for adoption of OAuth 2.0 for Native Apps, see
http://datatracker.ietf.org/doc/draft-wdenniss-oauth-native-apps/<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fdatatracker.ietf.org%2fdoc%2fdraft-wdenniss-oauth-native-apps%2f&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=2cQwLQLkCiFWxIIav5TMZFe5VFE%2bXrc3OQq46q0D0U8%3d>

Ciao
Hannes & Derek

_______________________________________________
OAuth mailing list
[email-masked]<javascript:_e(%7B%7D,'cvml',[email-masked]');>
https://www.ietf.org/mailman/listinfo/oauth<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2foauth&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=m5%2f3yd6Jtwu0mVOejfZi1BQsYtBZ0WjfHTaC4g9GmK0%3d>

_______________________________________________
OAuth mailing list
[email-masked]<javascript:_e(%7B%7D,'cvml',[email-masked]');>
https://www.ietf.org/mailman/listinfo/oauth<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2foauth&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=m5%2f3yd6Jtwu0mVOejfZi1BQsYtBZ0WjfHTaC4g9GmK0%3d>

_______________________________________________
OAuth mailing list
[email-masked]<javascript:_e(%7B%7D,'cvml',[email-masked]');>
https://www.ietf.org/mailman/listinfo/oauth<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2foauth&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=m5%2f3yd6Jtwu0mVOejfZi1BQsYtBZ0WjfHTaC4g9GmK0%3d>

--
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fnat.sakimura.org%2f&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=LKjUffXFJjc4HJqcwkgWINQK65ASdL29nfenSiJspjA%3d>
@_nat_en

---

From: William Denniss <[email-masked]>
Date: Thu, 21 Jan 2016 14:11:02 +0800

I believe this is important work.

The original OAuth 2 spec left the topic of native apps largely undefined
which is fair enough, the mobile-first revolution had yet to really take
hold and people didn't have much implementation experience for OAuth on
mobile. But we've come a long way since then, we have the experience now
and I think there is a need for leadership in this space, and that it makes
sense for the OAUTH-WG to continue our work and provide that leadership.

The risk of not defining a best practice for native apps is dilution of the
open standards – if everyone implements OAuth differently for native apps,
and RPs have to write IDP-specific code then what is the point of having
OAuth as a standard in the first place? Security is a major concern as
well, there are a lot of ways to mess this up and the security situation
for OAuth in many native apps is not nearly as good as it could be.

By providing leadership in the form of a working group document, we can
present community advice with the hope that IDPs and RPs alike will follow
our recommendations, resulting in more interoperability, better usability
and higher security.

The best part about this spec is that it's pure OAuth! Just wrapped with
some native app specific recommendations for both RPs and IDPs, to achieve
the desired levels of usability and security on mobile.

I will point out that we have rough consensus and running code. The rough
consensus can be seen from the WG votes, and the sentiment on this thread
(your dissenting opinion notwithstanding). Regarding running code, my team
is in the process of open sourcing libraries that will implement this best
practice to the letter (and the code's already running, I assure you). The
proprietary Google Sign-in and Facebook Sign-in SDKs are also using in-app
browser tabs for OAuth flows in production today, which I think is further
evidence that this is a viable pattern.

This document and proposal was never part of the OpenID working group that
you refer to below.

I'm not saying the document is perfect, and it is definitely in need of an
update! But I'm committed to listening to the community and taking it
forward. Now that the dependencies have launched, and our library
implementations are done, I plan to update the doc with the feedback from
this community, and the lessons we and others have learnt from our
implementations.

I hope the working group will consider adopting this document.

Kind Regards,
William

On Thu, Jan 21, 2016 at 12:33 PM, Anthony Nadalin <[email-masked]>
wrote:

> This work had many issues in the OpenID WG where it failed why should this
> be a WG item here ? The does meet the requirements for experimental, there
> is a fine line between informational and experimental, I would be OK with
> either but prefer experimental, I don’t think that this should become a
> standard.
>
>
>
> *From:* OAuth [mailto:[email-masked]] *On Behalf Of *John Bradley
> *Sent:* Wednesday, January 20, 2016 12:11 PM
> *To:* Nat Sakimura <[email-masked]>
> *Cc:* [email-masked]
> *Subject:* Re: [OAUTH-WG] Call for adoption: OAuth 2.0 for Native Apps
>
>
>
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-wdenniss-oauth-native-apps-00%23appendix-A&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=JWJmgLNPYe96GHUu67JZ1xdUN3T3c7kDNLQc8wniaDQ%3d>
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fdeveloper.apple.com%2flibrary%2fprerelease%2fios%2freleasenotes%2fGeneral%2fWhatsNewIniOS%2fArticles%2fiOS9.html%23%2f%2fapple_ref%2fdoc%2fuid%2fTP40016198-DontLinkElementID_26&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=hQ6JGBJjX%2fwm36N6MpGeXbNQzwJaf6G6eyGxRVQH4ZA%3d>
>
>
>
> <https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2faaronparecki.com%2f&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=S5aoD2X1pzBvy3qsEfPfyDCY0SQRqN7J6M%2fDLJz%2fUew%3d>
>
> @aaronpk
> <https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2ftwitter.com%2faaronpk&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=nEN2jz2zsIWlcJ%2bSWotUH8oLPFJ8ii4o49G0cEHYmQo%3d>
>
>
>
>
>
> <https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fdatatracker.ietf.org%2fdoc%2fdraft-wdenniss-oauth-native-apps%2f&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=2cQwLQLkCiFWxIIav5TMZFe5VFE%2bXrc3OQq46q0D0U8%3d>
>
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2foauth&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=m5%2f3yd6Jtwu0mVOejfZi1BQsYtBZ0WjfHTaC4g9GmK0%3d>
>
>
>
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2foauth&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=m5%2f3yd6Jtwu0mVOejfZi1BQsYtBZ0WjfHTaC4g9GmK0%3d>
>
>
>
>
> <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2foauth&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=m5%2f3yd6Jtwu0mVOejfZi1BQsYtBZ0WjfHTaC4g9GmK0%3d>
>
>
>
>
>
>
>
> --
> Nat Sakimura (=nat)
>
> <https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fnat.sakimura.org%2f&data=01%7c01%7ctonynad%40microsoft.com%7cfd93a3d44152476b186e08d321d5d579%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=LKjUffXFJjc4HJqcwkgWINQK65ASdL29nfenSiJspjA%3d>
> @_nat_en
>
>
>
>
>

---

From: Antonio Sanso <[email-masked]>
Date: Thu, 21 Jan 2016 06:15:02 +0000

+1 for adoption. I do really think this fills a current gap.

regards

antonio

---

From: Roland Hedberg <[email-masked]>
Date: Thu, 21 Jan 2016 07:56:26 +0000

+1 for adoption

> 21 jan 2016 kl. 07:11 skrev William Denniss <[email-masked]>:
> 
> The original OAuth 2 spec left the topic of native apps largely undefined which is fair enough, the mobile-first revolution had yet to really take hold and people didn't have much implementation experience for OAuth on mobile. But we've come a long way since then, we have the experience now and I think there is a need for leadership in this space, and that it makes sense for the OAUTH-WG to continue our work and provide that leadership.
> 
> The risk of not defining a best practice for native apps is dilution of the open standards – if everyone implements OAuth differently for native apps, and RPs have to write IDP-specific code then what is the point of having OAuth as a standard in the first place? Security is a major concern as well, there are a lot of ways to mess this up and the security situation for OAuth in many native apps is not nearly as good as it could be.
> 
> By providing leadership in the form of a working group document, we can present community advice with the hope that IDPs and RPs alike will follow our recommendations, resulting in more interoperability, better usability and higher security.
> 
> The best part about this spec is that it's pure OAuth! Just wrapped with some native app specific recommendations for both RPs and IDPs, to achieve the desired levels of usability and security on mobile.
> 
> I will point out that we have rough consensus and running code. The rough consensus can be seen from the WG votes, and the sentiment on this thread (your dissenting opinion notwithstanding). Regarding running code, my team is in the process of open sourcing libraries that will implement this best practice to the letter (and the code's already running, I assure you). The proprietary Google Sign-in and Facebook Sign-in SDKs are also using in-app browser tabs for OAuth flows in production today, which I think is further evidence that this is a viable pattern.
> 
> This document and proposal was never part of the OpenID working group that you refer to below.
> 
> I'm not saying the document is perfect, and it is definitely in need of an update! But I'm committed to listening to the community and taking it forward. Now that the dependencies have launched, and our library implementations are done, I plan to update the doc with the feedback from this community, and the lessons we and others have learnt from our implementations.
> 
> On Thu, Jan 21, 2016 at 12:33 PM, Anthony Nadalin <[email-masked]> wrote:
> There is https://tools.ietf.org/html/draft-wdenniss-oauth-native-apps-00#appendix-A which has some mention of SFSafariViewController and Chrome Custom Tabs.
> 
> Maybe more is needed?
> 
> 
> 
> For reference, https://developer.apple.com/library/prerelease/ios/releasenotes/General/WhatsNewIniOS/Articles/iOS9.html#//apple_ref/doc/uid/TP40016198-DontLinkElementID_26
> 
> 
> 
> On Tue, Jan 19, 2016 at 3:46 AM, Hannes Tschofenig <[email-masked]> wrote:
> 
> Hi all,
>

---

From: George Fletcher <[email-masked]>
Date: Thu, 21 Jan 2016 13:14:40 -0500

I'm also +1 for adoption

-- 
Chief Architect
Identity Services Engineering     Work: [email-masked]
AOL Inc.                          AIM:  gffletch
Mobile: +1-703-462-3494           Twitter: http://twitter.com/gffletch
Office: +1-703-265-2544           Photos: http://georgefletcher.photography

---

From: Phil Hunt <[email-masked]>
Date: Mon, 25 Jan 2016 10:35:18 -0800

+1. I think this helps clarify some mis-conceptions that are out there.

Phil

@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

> On Jan 21, 2016, at 10:14 AM, George Fletcher <[email-masked]> wrote:
> 
> I'm also +1 for adoption
> 
>>> 21 jan 2016 kl. 07:11 skrev William Denniss <[email-masked]> <mailto:[email-masked]>:
>>> 
>>> On Thu, Jan 21, 2016 at 12:33 PM, Anthony Nadalin <[email-masked]> <mailto:[email-masked]> wrote:
>>> From: OAuth [mailto:[email-masked] <mailto:[email-masked]>] On Behalf Of John Bradley
>>> To: Nat Sakimura <[email-masked]> <mailto:[email-masked]>
>>> Cc: [email-masked] <mailto:[email-masked]>
>>> On Jan 20, 2016, at 5:08 PM, Nat Sakimura <[email-masked]> <mailto:[email-masked]> wrote:
>>> 
>>> 
>>> 
>>> 2016年1月21日木曜日、John Bradley<[email-masked]> <mailto:[email-masked]>さんは書きました:
>>> 
>>> On Jan 20, 2016, at 3:38 PM, Brian Campbell <[email-masked]> <mailto:[email-masked]> wrote:
>>> 
>>> 
>>> 
>>> On Wed, Jan 20, 2016 at 10:45 AM, John Bradley <[email-masked]> <mailto:[email-masked]> wrote:
>>> 
>>> On Jan 20, 2016, at 12:40 PM, Aaron Parecki <[email-masked]> <mailto:[email-masked]> wrote:
>>> 
>>> 
>>> 
>>> On Tue, Jan 19, 2016 at 3:46 AM, Hannes Tschofenig <[email-masked]> <mailto:[email-masked]> wrote:
>>> 
>>> Hi all,
>>> 
> Identity Services Engineering     Work: [email-masked] <mailto:[email-masked]>
> AOL Inc.                          AIM:  gffletch
> Mobile: +1-703-462-3494           Twitter: http://twitter.com/gffletch <http://twitter.com/gffletch>
> Office: +1-703-265-2544           Photos: http://georgefletcher.photography <http://georgefletcher.photography/>