<html><head><base href="x-msg://1607/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Facebook has their own unique version of OAuth 2.0. It is not compliant with any particular draft. They have a token endpoint that is more OAuth 1.0.<div><br></div><div>They made a new token endpoint that takes the client secret and the access_token and returns a long lived access token.</div><div><br></div><div>I am assuming that OIC will use refresh tokens for that. </div><div><br></div><div>I was actually looking for similarities between the two profiles of OAuth 2.0 for another project when I noticed facebooks announcement to developers on the API change.</div><div><br></div><div>I mostly thought it strange because they do support both a 'code token' and a 'signed_request token' response type like OIC that already has the required functionality.</div><div><br></div><div>They may have a good reason for doing it via a extension to OAuth 2.0 though I don't yet understand it.</div><div><br></div><div>I don't think it has any bearing on our work.</div><div><br></div><div>On the upside I did find their use of multiple response type is consistent with ours.</div><div><br></div><div>John B.</div><div><br><div><div>On 2012-02-02, at 3:22 PM, Anthony Nadalin wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div bgcolor="white" lang="EN-US" link="blue" vlink="purple"><div class="WordSection1" style="page: WordSection1; "><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(31, 73, 125); ">FB will be still standards compliant I bet, but not using an extension that has been through the standards process, BUT using an extension point that is part of the OAUTH V2 standard. Also this article talks about authentication mostly which OAUTH tries very hard to avoid (and leave that to HTTP)and only deal with authorization, so this article is misleading in that sense.<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div><div style="border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; border-top-style: solid; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding-top: 3pt; padding-right: 0in; padding-bottom: 0in; padding-left: 0in; "><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span>Nat Sakimura [mailto:sakimura@gmail.com]<span class="Apple-converted-space"> </span><br><b>Sent:</b><span class="Apple-converted-space"> </span>Thursday, February 02, 2012 10:12 AM<br><b>To:</b><span class="Apple-converted-space"> </span>Anthony Nadalin<br><b>Cc:</b><span class="Apple-converted-space"> </span>Mike Jones; <a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-ab] Facebook OAuth extension ruffles feathers, nixes user access permission<o:p></o:p></span></div></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">I suppose the article is not talking about OpenID Connect at all but just questioning why they creat yet another way of extending the access token validity time while OAuth 2.0 has a defined way of doing it. <o:p></o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">I can sort of understand it. Being not standard compliant to fragment is the market is a valid strategy for the largest player. <br><br>=nat via iPhone<o:p></o:p></div></div><div><p class="MsoNormal" style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 12pt; font-size: 11pt; font-family: Calibri, sans-serif; "><br>On 2012/02/03, at 3:02, Anthony Nadalin <<a href="mailto:tonynad@microsoft.com" style="color: blue; text-decoration: underline; ">tonynad@microsoft.com</a>> wrote:<o:p></o:p></p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt; "><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(31, 73, 125); ">What FB does is their business, they have created an extension that serves their own business needs, it’s not part of OAUTH (but seems to fit the extension model). Everyone is allowed to create extensions that they feel are needed. I believe that they feel that OpenID Connect is too complicated for them to implement thus they have gone their worn route.</span><o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(31, 73, 125); "> </span><o:p></o:p></div><div><div style="border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; border-top-style: solid; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding-top: 3pt; padding-right: 0in; padding-bottom: 0in; padding-left: 0in; "><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span><a href="mailto:openid-specs-ab-bounces@lists.openid.net" style="color: blue; text-decoration: underline; ">openid-specs-ab-bounces@lists.openid.net</a><span class="Apple-converted-space"> </span>[mailto:<a href="mailto:openid-specs-ab-bounces@lists.openid.net" style="color: blue; text-decoration: underline; ">openid-specs-ab-bounces@lists.openid.net</a>]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Mike Jones<br><b>Sent:</b><span class="Apple-converted-space"> </span>Thursday, February 02, 2012 9:50 AM<br><b>To:</b><span class="Apple-converted-space"> </span><a href="mailto:openid-specs-ab@lists.openid.net" style="color: blue; text-decoration: underline; ">openid-specs-ab@lists.openid.net</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>[Openid-specs-ab] Facebook OAuth extension ruffles feathers, nixes user access permission</span><o:p></o:p></div></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "> <o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><a href="http://www.zdnet.com/blog/identity/facebook-oauth-extension-ruffles-feathers-nixes-user-access-permission/192?tag=mantle_skin;content" style="color: blue; text-decoration: underline; ">http://www.zdnet.com/blog/identity/facebook-oauth-extension-ruffles-feathers-nixes-user-access-permission/192?tag=mantle_skin;content</a><o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "> <o:p></o:p></div></div></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt; "><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 12pt; font-family: 'Times New Roman', serif; ">_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net" style="color: blue; text-decoration: underline; ">Openid-specs-ab@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" style="color: blue; text-decoration: underline; ">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><o:p></o:p></span></div></div></blockquote></div>_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>http://lists.openid.net/mailman/listinfo/openid-specs-ab</div></span></blockquote></div><br></div></body></html>