.Nat Zone

Digital Identity et al.

「 OAuth 」 一覧

no image

Re: Limitations of the OAuth 2.0 definition of “Client”

  2012/12/30    OAuth

Thomas Hardjono has a very good blog entry <<Limitations of the OAuth 2.0 definition of “Client”>>. The essence of the entry is that, the definition of “client” in OAuth 2.0 (RFC6749) is too limiting and does not fit with many current …

no image

Hyperlinked OAuth

  2012/12/13    OAuth

I just published a new I-D on the hyperlinked oauth that I talked at IETF 85. Since it was pointed out that the “_links” member is actually holding metadata about the response, I named the document accordingly. It is fairly …

no image

[OAuth] Resource Owner != Client User

  2012/12/12    OAuth

I have been preaching this numerous time, but let me do it once more. There seems to be a very common misperception that in OAuth that the Resource Owner (the entity who gives permission for the resource access, aka “authorization”) …

Registered Token Profile for OAuth 2.0

  2012/08/03    identity, OAuth, OpenID Connect , , , ,

So, ID Token in OpenID connect is audience restricted to the client while the OAuth bearer access token is audience restricted to the protected resource. It is a bearer. It can be used by anybody. It is a common model …

OpenID Connect Stripped down to just “Authentication” (aka OAuth Authentication)

So, OpenID Connect provides a lot of advanced facilities to fulfill so many additional feature requested by the member community. It indeed is full of feature that is not Authentication. However, that does not mean that it cannot be used …