Recently active topics in OAuth

I have an application for which I'm adding an API. OAuth seems like a good idea as there are libraries around the place already. However, I don't need the token exchange and end-user verification. If the consumer gives me the right key for the provided signature, then that's as far as I need to go.

It seems that the 'request token' part of the process is as far as I need to go so long as I can add other request variables into it.

How does OAuth compare with ticket granting services like Kerberos?

I understand that OAuth is like the ticket granting service (TGS) in Kerberos.
What about the other parts? Can OAuth be organized into domains?
Can TGS be delegated, in addition to primary services?

Are the threat models the same? Are the protection models the same?
If the comparison hasn't been made, does anyone think it is worthwhile to study this?

-chris

I am not sure how signature works from consumer and service provider?
i am still not clear who should generate signature? consumer or Service Provider?

i feel like i saw one somewhere, but it's not on oauth.net right now. i'm interested in supporting oauth for a new social network, but i'm not sure which other sites we'd be able to connect to.

SAML 2 is an authentication standard that enable federation of user account between websites (service providers, SP). When an account is federated, the user may choose to share some of it's resources with SP. It really look like the goal of OAuth

rickwordy asked this question on the blog. I haven't seen XACML before, any one fancy a guess?

any simple, 10 line code that can do oAuth request rather than a whole class

When researching the issue I reported earlier (http://getsatisfaction.com/oauth/topi...) I tried to go reference the code samples in the code section of the OAuth website and came across all of the libraries with their various incarnations of the signing. For example, I drew up the following explaining how each of the various libraries build the signature base string:

Python:
- endpoint
- normalized request parameters
- http method
- consumer secret
- token secret

Ruby (oauth.rb)
- consumer secret
- consumer key
- token
- token secret
- http method
- endpoint
- normalized request parameters
- nonce
- timestamp

This version seems to be out of sync with the spec, and appears to be superceded by the gem version in the oauth folder underneath the ruby section. Also note that rather than combining each element of the signature base string with an ampersand, this code created key value pairs, url-encoded style, which it then combines with ampersands.

oauth.rb: request_method=GET&request_uri=http://foo.com
the spec's: GET&http://foo.com
Please note i'm not uri encoding the above string.

It seems like this file should removed from the code repo, since it confused me and possibly has confused others.

Ruby (oauth rubygem)

This version seems to match the spec, except for some bugs in the signature classes (hmac_class is self-referential instead of to the concrete implementations, which don't seem to exist).

PHP (OAuth.php in the google code project)
- consumer secret
- consumer key
- token
- token secret
- http method
- endpoint
- normalized request parameters
- timestamp
- nonce

PHP (http://teczno.com/HTTP_Request_Oauth....)
- This matches the spec as far as I can tell

Perl
- This matches the spec as far as I can tell

C#
- This matches the spec as far as I can tell, with the exception that is it doesn't have a facility for signing requests with form bodies

Of the 7 versions I showed here, less than half of them can be used to generate a valid oauth signature at present. Or at least a valid OAuth signature as I understand the spec. Given that, someone coming into the system clean (like me) can get really confused (which I did :)).

That was quite a lot of text before I got to my point, but to me it seems like there should be a page out there on the oauth.net websites that has a up to date status on each of the available code libraries. Such a page would really go a long way to help people no where they should go to learn this spec.

can oauth just take the timestamp, concatenate it with "&" and the nonce string, and then sha1 with the secret, and pass that as the signature? Right now normalizing all the params can be quite a lot of work and will timestamp + nonce be good for creating the signature?

does oauth.net have a simple sample service that can provide data when the correct request is passed? the service can just return some simple response like the current time as a string "10:30:23 Apr 17, 2008 Thursday" or some array like the date string and a = 1, b = 2.34 in xml or json.

How does OAuth compare and contrast with OpenID?

I understand that OpenID provides a way for a user to provide a distributed authentication mechanism, which OAuth covers as well. I also believe that OAuth goes further in some respects by documenting things that OpenID leaves up to the providers. Is this accurate?

Are there any other ways that these two systems compare and contrast?

Hi all,

We in G.ho.st are working on an open source project that also deals with open authentication techniques. I just returned from FOSDEM where I heard about OAuth and projects and developers that [plan to] use it. Naturally I was highly interested in learning OAuth.

Now that I did, I have a question: you say in http://oauth.net/about/ that OAuth is designed for open source software where there can be no secrets. How do you plan dealing with the problem where Consumer is an open source application so that Consumer Key / Secret cannot be kept in secret?

Regards

Anton Bar

http://G.ho.st... No walls

The OAuth spec says that request parameters should be normalized. Particularly "9.1.1. Normalize Request Parameters" says that all parameters included in the query string and the body must be sorted and signed. What if the body is XML?

Example: Web app posts a request to G.ho.st API:

POST /soap/someservice HTTP/1.1
Host: api.g.ho.st
Content-length: ...
Cotent-type: ...

<xml>
<param1>value1</param1>
<param2>value2</param2>
...
</xml>

I know Twitter is working on something for their own purposes, but will there be open source Rails implementations out there soon?

Hi all, hard at work integrating OAuth into Satisfaction and I came across what seems to be a mistake in the spec.

Appendix A.5.2. lists the resulting signature as 'Gcg/323lvAsQ707p+y41y14qWfY' whereas I'm getting 'Gcg/323lvAsQ707p+y41y14qWfY=' from my tests.

Calculating the HMAC-SHA1 digest for the signature base string provided in Appendix A.5.1. I get the 20 bytes:
[25, 200, 63, 223, 109, 229, 188, 11, 16, 239, 78, 233, 251, 46, 53, 203, 94, 42, 89, 246]

When bytes listed above are base64 encoded according to RFC 2045 you get 'Gcg/323lvAsQ707p+y41y14qWfY=', whereas modified-base64 (which leaves out the padding) according to RFC 2152 matches the first version.

Which is correct? The Spec specifically mentions RFC 2045.