Subject: [OAUTH-WG] OAuth Device Flow

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 5 Nov 2015 01:44:38 +0100

FYI: A couple of us got together and re-published an old, expired draft
about the OAuth Device Flow.

Here is the document:
https://tools.ietf.org/html/draft-denniss-oauth-device-flow-00

For the -00 version we tired to keep it inline with what has been
available with draft-recordon-oauth-v2-device-00. In upcoming versions
of this document we would like to capture existing deployment.

Here are two deployment examples that are reasonably well described:

- Google
https://developers.google.com/youtube/v3/guides/auth/devices

- Facebook
https://developers.facebook.com/docs/facebook-login/for-devices

Ciao
Hannes

---

From: William Denniss <[email-masked]>
Date: Thu, 5 Nov 2015 11:26:23 +0900

Google has additional documentation here:
https://developers.google.com/identity/protocols/OAuth2ForDevices

The implementation mostly follows the original draft, but there are a few
differences. Also we've learnt a lot about the security and usability
implications of this flow along the way, which would be good to document.

On Thu, Nov 5, 2015 at 9:44 AM, Hannes Tschofenig <[email-masked]
> wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: Aaron Parecki <[email-masked]>
Date: Fri, 13 Nov 2015 12:46:48 -0800

In reading this over, I noticed a subtle difference from the Facebook and
Google implementations, and I'm wondering if this was intentional or not.

Section 3.1 says "The authorization server prompts the end-user to
authorize the client's request by entering the end-user code provided by
the client." The introduction has even more explicitly different wording:
"(D) ... If the end-user agrees to the client's access request, the
end-user enters the end-user code provided by the client."

However this is different from Facebook and Google's implementations, which
work as follows:

   - Device shows the verification URI and code to the user
   - The user visits the URL and is prompted to sign in to the service
   (Google has the extra step of then choosing which Youtube account to use)
   - The user is then prompted to enter the device code
   - After entering the device code, the authorization prompt is displayed

In reading this draft, the implication is that the act of entering the code
also is the authorization. The problem is that the server won't know things
like the scope or application name until after the code is entered, so it
can't properly show an authorization prompt.

I think this needs to be reworded to separate entering the code from
showing the authorization prompt. I believe it is only a wording change.
Maybe something more like:

3.1 "The authorization server prompts the end-user to enter the end-user
code provided by the client, after which it prompts the end-user to
authorize the client's request."

and in the introduction:

1. (D) "The authorization server authenticates the end-user (via the
user-agent) and prompts the end-user to enter the end-user code provided by
the client. The authorization server validates the end-user code and
prompts the end-user to grant the client's access request."

----
Aaron Parecki
aaronparecki.com
@aaronpk <http://twitter.com/aaronpk>

On Wed, Nov 4, 2015 at 4:44 PM, Hannes Tschofenig <[email-masked]

---

From: Aaron Parecki <[email-masked]>
Date: Fri, 13 Nov 2015 14:02:17 -0800

I just noticed a typo, section 3.2 should refer to RFC6749 section 4.1.3
instead of 4.1.1

https://tools.ietf.org/html/draft-denniss-oauth-device-flow-00#section-3.2

Section 4.1.1 is the authorization request, 4.1.3 is the access token
request which I believe is what's supposed to be referenced.

----
Aaron Parecki
aaronparecki.com