<font size=2 face="sans-serif">> </font><font size=3>I would need to
know more about the other credentials. I am assuming a desktop app
if it is Eclipse based. </font>
<br>
<br><font size=2 face="sans-serif">That's right - an Eclipse-based desktop
app. The login dialog raised by the app ultimately uses Apache httpclient
to negotiate auth with the AS. That dialog allows for the entry of
username/password, a client-based certificate, or smart-card. On
the feature list is SPENGO (Kerberos). Also a CLI, similarly using
httpclient.</font>
<br>
<br><font size=2 face="sans-serif">> </font><font size=3> If it
is going to authenticate based on some other credential already in the
browser then use the code flow. </font>
<br>
<br><font size=2 face="sans-serif">This hadn't occurred to me. Basically
the user needs to know how the AS is configured for auth. If cert-based
or Kerberos, they enter their certificate and the native client (with auto-redirection
turned off) initiates the code flow, assuming no challenges, until its
redirect_uri returns in the Location header. If the AS is configured
for username/password, use the password flow.</font>
<br>
<br><font size=2 face="sans-serif">Ideally I was thinking that the client
wouldn't have to switch flows based on how the AS is configured, but perhaps
that's unrealistic. (In our OAuth extension, we implemented a proprietary
sign-in endpoint that optionally took username/password, and returned a
token).<br>
</font>
<br>
<table width=223 style="border-collapse:collapse;">
<tr height=8>
<td width=223 bgcolor=white style="border-style:solid;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;"><font size=1 face="Verdana"><b><br>
<br>
<br>
Todd Lainhart<br>
Rational software<br>
IBM Corporation<br>
550 King Street, Littleton, MA 01460-1250</b></font><font size=1 face="Arial"><b><br>
1-978-899-4705<br>
2-276-4705 (T/L)<br>
lainhart@us.ibm.com</b></font></table>
<br>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">John Bradley <john.bradley@wingaa.com></font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">Torsten Lodderstedt
<torsten@lodderstedt.net>, </font>
<br><font size=1 color=#5f5f5f face="sans-serif">Cc:
</font><font size=1 face="sans-serif">Todd W Lainhart/Lexington/IBM@IBMUS,
"openid-specs@lists.openid.net" <openid-specs@lists.openid.net></font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">10/26/2013 08:10 AM</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">Re: Seeking
guidance on the implementation of native/rich client flow</font>
<br>
<hr noshade>
<br>
<br>
<br><font size=3>I would have the client use the resource owner credentials
flow if it has the password. If it is going to authenticate based
on some other credential already in the browser then use the code flow.
</font>
<br>
<br><font size=3>I would need to know more about the other credentials.
I am assuming a desktop app if it is Eclipse based. </font>
<br>
<br><font size=3>John B. </font>
<br><font size=3><br>
Sent from my iPhone</font>
<br><font size=3><br>
On Oct 26, 2013, at 8:52 AM, Torsten Lodderstedt <</font><a href=mailto:torsten@lodderstedt.net><font size=3 color=blue><u>torsten@lodderstedt.net</u></font></a><font size=3>>
wrote:<br>
</font>
<br><font size=3>We use OIDC in conjunction with resource owner password
credential grant for native apps (no 3rd party apps, just our own apps)<br>
</font>
<br><font size=3><br>
<br>
Todd W Lainhart <</font><a href=mailto:lainhart@us.ibm.com><font size=3 color=blue><u>lainhart@us.ibm.com</u></font></a><font size=3>>
schrieb:</font>
<br><font size=2 face="sans-serif">I'm referencing </font><a href="http://openid.net/specs/openid-connect-core-1_0.html"><font size=3 color=blue><u>http://openid.net/specs/openid-connect-core-1_0.html</u></font></a><font size=3>
<br>
</font><font size=2 face="sans-serif"><br>
We have an Authorization Server that supports SSO via session extensions
to OAuth 2.0. We're looking to replace that protocol w/ OIDC. There's
a couple of sticky points that I'm not sure how to translate.</font><font size=3>
<br>
</font><font size=2 face="sans-serif"><br>
1) Rich/Native Client login</font><font size=3> <br>
</font><font size=2 face="sans-serif"><br>
Imagine an Eclipse-based rich client accepts user credentials and receives
a bearer token in return. The negotiation may be basic, credentials-based,
SPENGO. The client is anonymous. Rather than using the Resource
Owner Password Credentials Grant (where username/password are REQUIRED
parameters), we opted for a custom endpoint so that the AS could determine
if the request was authenticated in the absence of username/password. Similar
to Resource Owner Password Credentials Grant.</font><font size=3> <br>
</font><font size=2 face="sans-serif"><br>
I'm wondering what the guidance is for such a setup in OIDC. Implicit
requires the native client to follow (presumably) 302s with the AS until
it gets the final 302 to the callback location. Seems messy for this
setup.</font><font size=3> <br>
</font><font size=2 face="sans-serif"><br>
In the absence of guidance/precedent, I'm inclined to think that a Resource
Owner Password Credentials Grant style extension is the way to go for this
scenario.</font><font size=3><br>
</font>
<table width=223 style="border-collapse:collapse;">
<tr height=8>
<td width=221 bgcolor=white style="border-style:solid;border-color:#000000;border-width:0px 0px 0px 0px;padding:1px 1px;"><font size=1 face="Verdana"><b><br>
<br>
<br>
Todd Lainhart<br>
Rational software<br>
IBM Corporation<br>
550 King Street, Littleton, MA 01460-1250</b></font><font size=1 face="Arial"><b><br>
1-978-899-4705<br>
2-276-4705 (T/L)</b></font><font size=1 color=blue face="Arial"><b><u><br>
</u></b></font><a href=mailto:lainhart@us.ibm.com><font size=1 color=blue face="Arial"><b><u>lainhart@us.ibm.com</u></b></font></a></table>
<br>
<p>
<hr><tt><font size=3><br>
specs mailing list</font></tt><tt><font size=3 color=blue><u><br>
</u></font></tt><a href=mailto:specs@lists.openid.net><tt><font size=3 color=blue><u>specs@lists.openid.net</u></font></tt></a><tt><font size=3 color=blue><u><br>
</u></font></tt><a href="http://lists.openid.net/mailman/listinfo/openid-specs"><tt><font size=3 color=blue><u>http://lists.openid.net/mailman/listinfo/openid-specs</u></font></tt></a>
<br><font size=3>_______________________________________________<br>
specs mailing list</font><font size=3 color=blue><u><br>
</u></font><a href=mailto:specs@lists.openid.net><font size=3 color=blue><u>specs@lists.openid.net</u></font></a><font size=3 color=blue><u><br>
</u></font><a href="http://lists.openid.net/mailman/listinfo/openid-specs"><font size=3 color=blue><u>http://lists.openid.net/mailman/listinfo/openid-specs</u></font></a>
<br>