Recently active topics in OAuth

I got some code to put into my gaget to verify ownership how do I add
this code.
Does it go in my modulePrefs as OAuth Consumer Key=" 248308281354"

I'm new to building gagets i was suprise i got one to function so far.

Thanks for any help.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++
You have successfully verified ownership of your gadget. You can now
access the OAuth Consumer Key and Consumer Secret Google uses to sign
outgoing gadgets.io.makeRequest calls to your servers.
The same key is used to verify the OAuth signatures of OpenSocial REST
& JSON-RPC calls from your servers to Google containers.

OAuth Consumer Key: 248308281354

OAuth Consumer Secret: GByr6oNK1cz2/mzas2Wa0tNZ

Note: The Consumer Key used by different containers will be of the
form <container>:<consumer>

E.g. orkut.com:248308281354, igoogle.com:248308281354

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
</consumer></container>

How are tokens saved on the service provider? Is it just a database change?

Also, how are they saved on the consumer side? Are they assigned to cookies?

Without a browser, is it still possible for a user to approve the token requests (so that the consumer can proceed to fetch the protected resources from the service provider)?

Please help For request_token, is https necessary, should oauth_signature_method be PLAINTEXT or HMAC-SHA1, if later what is the key, as token secret is not available yet? Grateful for any help.

Does anyone have an example of what a file post in rails would look like? Am having a hard time finding an example online, i assume it is something like @token.post(uri, {:file=>'mypic.jpg'}, {'Content-type'=>'multipart/form-data'}) but have had no luck getting this to work. Any help would be greatly appreciated. Examples of this are few and far between. Thanks

Is there a copy of the OAuth workflow diagram (http://oauth.net/core/diagram.png) in a scalable vector format?

rickwordy asked this question on the blog. I haven't seen XACML before, any one fancy a guess?

How do programmatic Consumers work in an environment that does not support redirection to a Service Provider's web site? that is, what credentials can we (a trusted service tier Consumer) obtain from a User which would allow us to interact on her behalf with selected Service Providers? Could we require Users to grant us (long-lasting, hopefully) rights during say, their registration with us? Is there an alternative?

For example, i'm working on an vBulletin Add-on which should use OAuth for connecting to twitter. Now it would be realy great if the people could create automaticaly an OAuth Account while installing my add-on instead of going to the site and registering manualy

i feel like i saw one somewhere, but it's not on oauth.net right now. i'm interested in supporting oauth for a new social network, but i'm not sure which other sites we'd be able to connect to.

Has anyone successfully used the Ruby oauth gem with Ning applications?

In this four legged scenario, there is a shared service provider, application 1 which holds the consumer data and application 2 which is trying to access data on application 1. How would this scenario look to the user?

My initial thought is that application 2 uses the OAuth 3 legged scenario to get access to the users data with Service Provider. They then use unique account id from service provider to identify user with application 1 and get authorization from application 1.

Anyone solve for this yet or have any recommendations?

I'm evaluating various techologies and methods for third party access to centrally held subscriber data. OAuth seems to be both simple and powerful.

Question: Has OAuth been included in any commercial products yet? If not, are their definite plans to deploy OAuth in a commercial product?

i cant seem to access the inner pages. Though i can see the home page..

How does OAuth compare with ticket granting services like Kerberos?

I understand that OAuth is like the ticket granting service (TGS) in Kerberos.
What about the other parts? Can OAuth be organized into domains?
Can TGS be delegated, in addition to primary services?

Are the threat models the same? Are the protection models the same?
If the comparison hasn't been made, does anyone think it is worthwhile to study this?

-chris

The OAuth spec says that request parameters should be normalized. Particularly "9.1.1. Normalize Request Parameters" says that all parameters included in the query string and the body must be sorted and signed. What if the body is XML?

Example: Web app posts a request to G.ho.st API:

POST /soap/someservice HTTP/1.1
Host: api.g.ho.st
Content-length: ...
Cotent-type: ...

<xml>
<param1>value1</param1>
<param2>value2</param2>
...
</xml>

How would I sign a request if it contains a file upload parameter, that in my case could be 100+ MB?

Does the specification (or an extension of it) support specifying parameters that do not need to be part of the signature so the server can ignore them?