<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 2.0cm 70.85pt 2.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="FR" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Hello Petteri,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> Your proposal is quite interesting.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> For the User Questioning API, I would have no objection to use your proposal in the drafts if it is adopted by the rest of the ecosystem,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Nicolas<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:FR">De :</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:FR"> Openid-specs-mobile-profile [mailto:openid-specs-mobile-profile-bounces@lists.openid.net]
<b>De la part de</b> Petteri Stenius<br>
<b>Envoyé :</b> jeudi 1 décembre 2016 16:59<br>
<b>À :</b> openid-specs-mobile-profile@lists.openid.net<br>
<b>Objet :</b> [Openid-specs-mobile-profile] Async authentication with polling and callback<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US">Hello everybody<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">At the Paris meeting in September there was some discussion about polling and callback mechanisms related to asynchronous functions.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">These mechanisms exist in both UQ and SIBA draft specifications. Polling is also defined in OAuth Device Flow draft.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">This proposal is an attempt to generalize async polling and callback mechanisms:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-18.0pt"><span lang="EN-US" style="font-family:Symbol">·</span><span lang="EN-US" style="font-size:7.0pt;font-family:"Times New Roman","serif"">
</span><span lang="EN-US">Define polling on the http level, not an application level function<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-18.0pt"><span lang="EN-US" style="font-family:Symbol">·</span><span lang="EN-US" style="font-size:7.0pt;font-family:"Times New Roman","serif"">
</span><span lang="EN-US">Callback is only a simple notification request, a client initiated request is required to fetch the actual content<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The two proposals work together, and make for example switching between polling and callback mechanisms very easy.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Petteri<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US">Polling defined on the http level<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Define mechanism with HTTP 303 redirect and Retry-After response header.</span><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif";color:black">
</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">303 redirect is used to define polling as sequence of http redirects the client follows until async operation completes and response appears.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The client MUST wait time indicated by Retry-After header before following a redirect. Failing to do so would result in 503 Service Unavailable error (with Retry-After header).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Semantics is comparable to "Wait a moment, the response will soon appear at this location"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The server is allowed to implement "long polling" by holding a response up to 30 seconds (see
<a href="https://tools.ietf.org/html/rfc6202#section-5.5">https://tools.ietf.org/html/rfc6202#section-5.5</a>)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Example of polling sequence:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:18.0pt;text-indent:-18.0pt"><span lang="EN-US">1.</span><span lang="EN-US" style="font-size:7.0pt;font-family:"Times New Roman","serif"">
</span><span lang="EN-US">Client begins async operation<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">POST /begin-async-operation HTTP/1.1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:18.0pt;text-indent:-18.0pt"><span lang="EN-US">2.</span><span lang="EN-US" style="font-size:7.0pt;font-family:"Times New Roman","serif"">
</span><span lang="EN-US">Server response with 303 status indicates client must begin polling for response. Server encodes state into querystring of redirect uri<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">HTTP/1.1 303 See Other<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Location: /async-response?opaque-server-state-1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Retry-After: 10<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:18.0pt;text-indent:-18.0pt"><span lang="EN-US">3.</span><span lang="EN-US" style="font-size:7.0pt;font-family:"Times New Roman","serif"">
</span><span lang="EN-US">Client waits at least 10 seconds before following the redirect<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">GET /async-response?opaque-server-state-1 HTTP/1.1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:18.0pt;text-indent:-18.0pt"><span lang="EN-US">4.</span><span lang="EN-US" style="font-size:7.0pt;font-family:"Times New Roman","serif"">
</span><span lang="EN-US">Server response with new uri where querystring has changed<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">HTTP/1.1 303 See Other<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Location: /async-response?opaque-server-state-2<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Retry-After: 10<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:18.0pt;text-indent:-18.0pt"><span lang="EN-US">5.</span><span lang="EN-US" style="font-size:7.0pt;font-family:"Times New Roman","serif"">
</span><span lang="EN-US">Client again waits before following the redirect<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">GET /async-response?opaque-server-state-2 HTTP/1.1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:18.0pt;text-indent:-18.0pt"><span lang="EN-US">6.</span><span lang="EN-US" style="font-size:7.0pt;font-family:"Times New Roman","serif"">
</span><span lang="EN-US">Server response with content when async operation has completed<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">HTTP/1.1 200 OK<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">"completed"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US">Callback is a simple notification request<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">My proposal for callback mechanism is a simple notification request.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Server encodes any state it needs into querystring of the notification request.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">For the client the querysring is opaque and the client must pass it as-is when fetching the actual content from the server.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Using a simple notification request removes the requirement for client to authenticate the callback request from server.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Example of callback sequence:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:18.0pt;text-indent:-18.0pt"><span lang="EN-US">1.</span><span lang="EN-US" style="font-size:7.0pt;font-family:"Times New Roman","serif"">
</span><span lang="EN-US">Client begins async operation<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">POST /begin-async-operation HTTP/1.1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:18.0pt;text-indent:-18.0pt"><span lang="EN-US">2.</span><span lang="EN-US" style="font-size:7.0pt;font-family:"Times New Roman","serif"">
</span><span lang="EN-US">Server response with 202 status indicates client needs to wait for callback<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">HTTP/1.1 202 Accepted<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:18.0pt;text-indent:-18.0pt"><span lang="EN-US">3.</span><span lang="EN-US" style="font-size:7.0pt;font-family:"Times New Roman","serif"">
</span><span lang="EN-US">When async operation completes server sends a notification request to client. Server encodes state into querystring of notification uri<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">GET /callback?opaque-server-state-3 HTTP/1.1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:18.0pt;text-indent:-18.0pt"><span lang="EN-US">4.</span><span lang="EN-US" style="font-size:7.0pt;font-family:"Times New Roman","serif"">
</span><span lang="EN-US">Client response is not processed by server<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">HTTP/1.1 204 No Content<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:18.0pt;text-indent:-18.0pt"><span lang="EN-US">5.</span><span lang="EN-US" style="font-size:7.0pt;font-family:"Times New Roman","serif"">
</span><span lang="EN-US">Client creates request uri and fetches content from server<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">GET /async-response?opaque-server-state-3 HTTP/1.1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:18.0pt;text-indent:-18.0pt"><span lang="EN-US">6.</span><span lang="EN-US" style="font-size:7.0pt;font-family:"Times New Roman","serif"">
</span><span lang="EN-US">Server response with content<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">HTTP/1.1 200 OK<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="FI">"completed"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FI"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="FI"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="FI"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="FI">Related discussion<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="FI"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">[Openid-specs-mobile-profile] Async authentication<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FI"><a href="http://lists.openid.net/pipermail/openid-specs-mobile-profile/Week-of-Mon-20161010/000615.html"><span lang="EN-US">http://lists.openid.net/pipermail/openid-specs-mobile-profile/Week-of-Mon-20161010/000615.html</span></a></span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">[OAUTH-WG] polling in the device flow<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><a href="https://www.ietf.org/mail-archive/web/oauth/current/msg02939.html">https://www.ietf.org/mail-archive/web/oauth/current/msg02939.html</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">[OAUTH-WG] Device Flow: Alternative to Polling<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif";color:black"><a href="https://www.ietf.org/mail-archive/web/oauth/current/msg16723.html">https://www.ietf.org/mail-archive/web/oauth/current/msg16723.html</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US">References<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">OAuth 2.0 Device Flow<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><a href="https://tools.ietf.org/html/draft-ietf-oauth-device-flow-03">https://tools.ietf.org/html/draft-ietf-oauth-device-flow-03</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">HTTP/1.1 Semantics and Content<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><a href="https://tools.ietf.org/html/rfc7231">https://tools.ietf.org/html/rfc7231</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Retry-After<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif";color:black"><a href="https://tools.ietf.org/html/rfc7231#section-7.1.3">https://tools.ietf.org/html/rfc7231#section-7.1.3</a>
</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Best Practices for the Use of Long Polling<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><a href="https://tools.ietf.org/html/rfc6202">https://tools.ietf.org/html/rfc6202</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<PRE>_________________________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
</PRE></body>
</html>