Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*"
Favorites infavorites:mine
Status closed:yes
Types is:question
Exclude -[tag]
For more details on advanced search visit our help page
Results tagged with Search options user 72057

OAuth is an open standard for authorizing access to data. It is a service that is complementary to, but distinct from, OpenID.

According to section 2 - client registration a client is registered with the authorization server before initiating any of the flows. Client registration includes specifying the client type (confiden …
answered Jun 15 '16 by HTLee
I should just answer my own question after stumbling upon the reason - device flow was removed from the OAuth 2 specification: due to lack of sufficient deployment expertise at that time … Citation from Appendix A: Acknowledgements - IETF OAuth device flow draft #01. Device flow is fairly common place these days. Some apps (e.g. HBO GO) on media devices (e.g. Roku) appears to utilize the …
answered Jan 16 '18 by HTLee
OAuth 2 device flow has an odd history. It's found in early versions of the RFC, but was then taken out seemingly without an explanation I could find. Recently, a new draft was proposed specifically … and has an example of it in action. Can anyone shed any light on why device flow was dropped from the OAuth 2 standard - are there security concerns we should know about? …
asked Jun 15 '16 by HTLee
, you don't want potentially untrustworthy clients like Mobile devices or Web browser to possess refresh tokens. This is why OAuth 2 implicit flow does not support refresh tokens. …
answered Jun 22 '16 by HTLee
This is something I've been wondering about as well. I don't think a solution exists right now, but I believe new systems can be designed to do this without downtime by leveraging Trust Assertions for …
answered Jun 18 '16 by HTLee
OAuth 2 client credentials grant is designed for communications between services. Authentication for client credentials grant typically involves passing a shared secret, instead of a login/password … Keycloak, at least for a proof of concept - it's an open source offering from RedHat. It utilizes Open ID Connect (OIDC), which is an extension of OAuth 2 (adds an ID layer). Keycloak's server admin documentation on service accounts for details. …
answered May 19 '16 by HTLee
One of my colleagues mentioned APIMAN (from RedHat) to me today, which seems to be what you need. It has an authentication layer among other useful features.
answered Oct 16 '15 by HTLee
What you're refering to is session management, which is not part of the OAuth 2 specification. In practice, for session management many solutions make use of the HTTP session. After successful …
answered Feb 12 '18 by HTLee
Even though the connection between user agent and servers are secure, the user agent may not be fully protected. Since authorization code flow ensures the user agent is not privy to the tokens, securi …
answered Jun 28 '16 by HTLee
Short answer is that it is undefined. If you want a library that supports both, ensure it explicitly states it supports both OAuth 2 and OIDC. If you were to draw a Venn diagram, OAuth 2 and OIDC … intersect each other but OAuth 2 also defines some flows that OIDC does not extend, and OIDC adds a flow that is not in OAuth 2. OAuth 2 flows: Authorization Code Grant Implicit Grant Resource Owner …
answered Jun 21 '16 by HTLee
The biggest security issue associated with Resource Owner Password Credentials Grant is that the application/client is privy to the user's password. For instance, if the application/client was from a …
answered Jan 16 '18 by HTLee