<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Some of this is being discussed in the Native apps WG. </div><div><br></div><div>If the client is a server then I think you want OAuth using a JWT access token. Connect may be useful but this sounds like plain OAuth. </div><div><br></div><div>The OAuth proof of possession drafts have a resource parameter. <br><br>Sent from my iPhone</div><div><br>On Jun 5, 2014, at 1:43 AM, Prabath Siriwardena <<a href="mailto:prabath@wso2.com">prabath@wso2.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr"><div><div>I have the following SOAP use case...</div><div><br></div><div>1. Using WS-Trust - I authenticate to the STS - and get a SAML Bearer Token with the required set of claims..</div><div>2. I use this as a supporting token to access a SOAP service.</div>
<div>3. SOAP service will validate the signature of the SAML token and if it is valid - I will be able to access it.</div><div><br></div><div>Now I am thinking of implementing the same in the following manner for REST APIs.</div>
<div><br></div><div>1. Using OpenID Connect talk to the token endpoint with client credential grant type and get a signed ID token with the required set of claims.</div><div>2. Set the JWT token in an HTTP header and talk to the secured API.</div>
<div>3. API should validate the signature of the JWT and if its valid and if it trusts the issuer - should let me in.</div><div><br></div><div>But - I find some limitations in spec to implement my REST use case.</div><div>
<br></div><div>1. OpenID Connect specification does not talk about client credentials grant type ? at the same time it does not say its a MUST to use authorization code or implicit.</div><div><br></div><div>2. AFAIK there is no HTTP binding to pass a JWT - please let me know if there is any?</div>
<div><br></div><div>Appreciate your thoughts on this...</div><div><br><br>Thanks & Regards,<br>Prabath<br><br>Twitter : @prabath<br>LinkedIn : <a href="http://www.linkedin.com/in/prabathsiriwardena">http://www.linkedin.com/in/prabathsiriwardena</a><br>
<br>Mobile : +94 71 809 6732<br><br><a href="http://blog.facilelogin.com">http://blog.facilelogin.com</a><br><a href="http://blog.api-security.org">http://blog.api-security.org</a><br></div></div></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Openid-specs-ab mailing list</span><br><span><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a></span><br><span><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></span><br></div></blockquote></body></html>