Subject: [OAUTH-WG] Info on how to implement a server

From: "Salz, Rich" <[email-masked]>
Date: Sat, 17 Aug 2019 17:23:33 +0000

What’s the WG consensus (heh) on the best guide to adding OAUTH support to an existing server so that it can act as an identity provider?  Which version of oauth is most widely deployed by relying parties these days?

I want to add OAUTH support to the IETF datatracker.

Thanks for any pointers.  Replies to me will be summarized for the list.

                /r$

---

From: John Bradley <[email-masked]>
Date: Sat, 17 Aug 2019 14:30:33 -0400

The openID Connect kind of OAuth server.

OAuth on its own is not designed to be secure for identity federation.

John B.

On 8/17/2019 1:23 PM, Salz, Rich wrote:
>
> What’s the WG consensus (heh) on the best guide to adding OAUTH
> support to an existing server so that it can act as an identity
> provider?  Which version of oauth is most widely deployed by relying
> parties these days?
>
>  
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Hans Zandbelt <[email-masked]>
Date: Sat, 17 Aug 2019 20:34:03 +0200

indeed OAuth != identity see https://oauth.net/articles/authentication/

Hans.

On Sat, Aug 17, 2019 at 8:31 PM John Bradley <[email-masked]> wrote:

> What’s the WG consensus (heh) on the best guide to adding OAUTH support to
> an existing server so that it can act as an identity provider?  Which
> version of oauth is most widely deployed by relying parties these days?
>
>
>
> OAuth mailing [email-masked]://www.ietf.org/mailman/listinfo/oauth
>

-- 
[email-masked]
ZmartZone IAM - www.zmartzone.eu

---

From: "Salz, Rich" <[email-masked]>
Date: Sun, 18 Aug 2019 19:41:02 +0000

Thanks for the links, folks.  I’m aware, and sorry for my sloppy terminology.

Imagine a service where anyone with a valid identity is authorized. There are many of these on the net. Collapsing authentication to authorization (“everyone authenticated is authorized”) seems not unreasonable.

But I don’t want to get distracted from my main goal.  Thanks.

From: Hans Zandbelt <[email-masked]>
Date: Saturday, August 17, 2019 at 2:34 PM
To: John Bradley <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [OAUTH-WG] Info on how to implement a server

indeed OAuth != identity see https://oauth.net/articles/authentication/<https://urldefense.proofpoint.com/v2/url?u=https-3A__oauth.net_articles_authentication_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=QNNK_MY9rFkxOH8kTY5Lb9XzaocnzqHfE2Qy1s1rKIQ&s=S3hNRZN-F73VNr2ls-yKN4bJPSuH4w92SmFc1PAvi4M&e=>

Hans.

On Sat, Aug 17, 2019 at 8:31 PM John Bradley <[email-masked]<mailto:[email-masked]>> wrote:

John B.

                /r$

OAuth mailing list

[email-masked]<mailto:[email-masked]>

https://www.ietf.org/mailman/listinfo/oauth<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_oauth&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=QNNK_MY9rFkxOH8kTY5Lb9XzaocnzqHfE2Qy1s1rKIQ&s=mYG4MvYj3IpSidDiigZr4NtmXiZ4uzpxrFAGd2WtoFM&e=>
_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_oauth&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=QNNK_MY9rFkxOH8kTY5Lb9XzaocnzqHfE2Qy1s1rKIQ&s=mYG4MvYj3IpSidDiigZr4NtmXiZ4uzpxrFAGd2WtoFM&e=>

--
[email-masked]<mailto:[email-masked]>
ZmartZone IAM - www.zmartzone.eu<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.zmartzone.eu&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=QNNK_MY9rFkxOH8kTY5Lb9XzaocnzqHfE2Qy1s1rKIQ&s=rdGZncYUqvlwcXI7_GGrc5Niii46pDWHdpVklsb0Ijg&e=>

---

From: Dick Hardt <[email-masked]>
Date: Sun, 18 Aug 2019 13:47:15 -0700

What is the goal?

On Sun, Aug 18, 2019 at 12:41 PM Salz, Rich <[email-masked]> wrote:

> Imagine a service where anyone with a valid identity is authorized. There
> are many of these on the net. Collapsing authentication to authorization
> (“everyone authenticated is authorized”) seems not unreasonable.
>
>
>
> *From: *Hans Zandbelt <[email-masked]>
> *Date: *Saturday, August 17, 2019 at 2:34 PM
> *To: *John Bradley <[email-masked]>
> *Cc: *"[email-masked]" <[email-masked]>
> *Subject: *Re: [OAUTH-WG] Info on how to implement a server
>
>
>
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__oauth.net_articles_authentication_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=QNNK_MY9rFkxOH8kTY5Lb9XzaocnzqHfE2Qy1s1rKIQ&s=S3hNRZN-F73VNr2ls-yKN4bJPSuH4w92SmFc1PAvi4M&e=>
>
>
>
> Hans.
>
>
>
> https://www.ietf.org/mailman/listinfo/oauth <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_oauth&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=QNNK_MY9rFkxOH8kTY5Lb9XzaocnzqHfE2Qy1s1rKIQ&s=mYG4MvYj3IpSidDiigZr4NtmXiZ4uzpxrFAGd2WtoFM&e=>
>
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_oauth&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=QNNK_MY9rFkxOH8kTY5Lb9XzaocnzqHfE2Qy1s1rKIQ&s=mYG4MvYj3IpSidDiigZr4NtmXiZ4uzpxrFAGd2WtoFM&e=>
>
>
>
>
> --
>
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.zmartzone.eu&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=QNNK_MY9rFkxOH8kTY5Lb9XzaocnzqHfE2Qy1s1rKIQ&s=rdGZncYUqvlwcXI7_GGrc5Niii46pDWHdpVklsb0Ijg&e=>

---

From: "Salz, Rich" <[email-masked]>
Date: Sun, 18 Aug 2019 21:05:04 +0000

As I said at the start of the thread: I want to add OAUTH support to the datatracker.

From: Dick Hardt <[email-masked]>
Date: Sunday, August 18, 2019 at 4:47 PM
To: Rich Salz <[email-masked]>
Cc: Hans Zandbelt <[email-masked]>, John Bradley <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [OAUTH-WG] Info on how to implement a server

What is the goal?

On Sun, Aug 18, 2019 at 12:41 PM Salz, Rich <[email-masked]<mailto:[email-masked]>> wrote:
Thanks for the links, folks.  I’m aware, and sorry for my sloppy terminology.

From: Hans Zandbelt <[email-masked]<mailto:[email-masked]>>
Date: Saturday, August 17, 2019 at 2:34 PM
To: John Bradley <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [OAUTH-WG] Info on how to implement a server

Hans.

John B.

                /r$

OAuth mailing list

https://www.ietf.org/mailman/listinfo/oauth<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_oauth&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=Un8tdGinIVpAqStU4GTgZWwQjRL7tMLUWFLfG5Hciv8&s=rL3JkU3byB6rcZdglzIdfzLMChWwgTRubGUYwiDl_k8&e=>

---

From: Dick Hardt <[email-masked]>
Date: Sun, 18 Aug 2019 14:08:32 -0700

That sounds like a means to an end.

Do you want to enable applications to call datatracker APIs?

On Sun, Aug 18, 2019 at 2:05 PM Salz, Rich <[email-masked]> wrote:

> *From: *Dick Hardt <[email-masked]>
> *Date: *Sunday, August 18, 2019 at 4:47 PM
> *To: *Rich Salz <[email-masked]>
> *Cc: *Hans Zandbelt <[email-masked]>, John Bradley <
> [email-masked]>, "[email-masked]" <[email-masked]>
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_oauth&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=Un8tdGinIVpAqStU4GTgZWwQjRL7tMLUWFLfG5Hciv8&s=rL3JkU3byB6rcZdglzIdfzLMChWwgTRubGUYwiDl_k8&e=>
>
>

---

From: Aaron Parecki <[email-masked]>
Date: Sun, 18 Aug 2019 14:09:48 -0700

Not to be pedantic, but adding OAuth support is a mechanism in support
of a goal. What's the end goal?

* Letting third party apps use the datatracker API?
* Letting people sign in to other apps with a datatracker account?

----
Aaron Parecki
aaronparecki.com

---

From: "Salz, Rich" <[email-masked]>
Date: Sun, 18 Aug 2019 21:28:43 +0000

>Do you want to enable applications to call datatracker APIs?

Not me, no.  But I know of a couple that will be able to benefit

---

From: "Salz, Rich" <[email-masked]>
Date: Sun, 18 Aug 2019 21:29:22 +0000

The latter.

---

From: Dick Hardt <[email-masked]>
Date: Sun, 18 Aug 2019 14:30:45 -0700

> The latter.

Then you want OpenID Connect

---

From: "Salz, Rich" <[email-masked]>
Date: Sun, 18 Aug 2019 21:55:56 +0000

>Then you want OpenID Connect

great, thank you for the pointer.