<font size=2 face="sans-serif">JohnB> </font><font size=3>I would have
the client use the resource owner credentials flow if it has the password.
</font>
<br><font size=2 face="sans-serif">Torsten> </font><font size=3>We use
OIDC in conjunction with resource owner password credential grant for native
apps (no 3rd party apps, just our own apps)</font>
<br>
<br><font size=2 face="sans-serif">John/Torsten -</font>
<br>
<br><font size=2 face="sans-serif">Are you returning an id_token in the
resource owner creds flow?<br>
</font>
<br>
<table width=223 style="border-collapse:collapse;">
<tr height=8>
<td width=223 bgcolor=white style="border-style:solid;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;"><font size=1 face="Verdana"><b><br>
<br>
<br>
Todd Lainhart<br>
Rational software<br>
IBM Corporation<br>
550 King Street, Littleton, MA 01460-1250</b></font><font size=1 face="Arial"><b><br>
1-978-899-4705<br>
2-276-4705 (T/L)<br>
lainhart@us.ibm.com</b></font></table>
<br>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">John Bradley <john.bradley@wingaa.com></font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">Torsten Lodderstedt
<torsten@lodderstedt.net>, </font>
<br><font size=1 color=#5f5f5f face="sans-serif">Cc:
</font><font size=1 face="sans-serif">Todd W Lainhart/Lexington/IBM@IBMUS,
"openid-specs@lists.openid.net" <openid-specs@lists.openid.net></font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">10/26/2013 08:10 AM</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">Re: Seeking
guidance on the implementation of native/rich client flow</font>
<br>
<hr noshade>
<br>
<br>
<br><font size=3>I would have the client use the resource owner credentials
flow if it has the password. If it is going to authenticate based
on some other credential already in the browser then use the code flow.
</font>
<br>
<br><font size=3>I would need to know more about the other credentials.
I am assuming a desktop app if it is Eclipse based. </font>
<br>
<br><font size=3>John B. </font>
<br><font size=3><br>
Sent from my iPhone</font>
<br><font size=3><br>
On Oct 26, 2013, at 8:52 AM, Torsten Lodderstedt <</font><a href=mailto:torsten@lodderstedt.net><font size=3 color=blue><u>torsten@lodderstedt.net</u></font></a><font size=3>>
wrote:<br>
</font>
<br><font size=3>We use OIDC in conjunction with resource owner password
credential grant for native apps (no 3rd party apps, just our own apps)<br>
</font>
<br><font size=3><br>
<br>
Todd W Lainhart <</font><a href=mailto:lainhart@us.ibm.com><font size=3 color=blue><u>lainhart@us.ibm.com</u></font></a><font size=3>>
schrieb:</font>
<br><font size=2 face="sans-serif">I'm referencing </font><a href="http://openid.net/specs/openid-connect-core-1_0.html"><font size=3 color=blue><u>http://openid.net/specs/openid-connect-core-1_0.html</u></font></a><font size=3>
<br>
</font><font size=2 face="sans-serif"><br>
We have an Authorization Server that supports SSO via session extensions
to OAuth 2.0. We're looking to replace that protocol w/ OIDC. There's
a couple of sticky points that I'm not sure how to translate.</font><font size=3>
<br>
</font><font size=2 face="sans-serif"><br>
1) Rich/Native Client login</font><font size=3> <br>
</font><font size=2 face="sans-serif"><br>
Imagine an Eclipse-based rich client accepts user credentials and receives
a bearer token in return. The negotiation may be basic, credentials-based,
SPENGO. The client is anonymous. Rather than using the Resource
Owner Password Credentials Grant (where username/password are REQUIRED
parameters), we opted for a custom endpoint so that the AS could determine
if the request was authenticated in the absence of username/password. Similar
to Resource Owner Password Credentials Grant.</font><font size=3> <br>
</font><font size=2 face="sans-serif"><br>
I'm wondering what the guidance is for such a setup in OIDC. Implicit
requires the native client to follow (presumably) 302s with the AS until
it gets the final 302 to the callback location. Seems messy for this
setup.</font><font size=3> <br>
</font><font size=2 face="sans-serif"><br>
In the absence of guidance/precedent, I'm inclined to think that a Resource
Owner Password Credentials Grant style extension is the way to go for this
scenario.</font><font size=3><br>
</font>
<table width=223 style="border-collapse:collapse;">
<tr height=8>
<td width=221 bgcolor=white style="border-style:solid;border-color:#000000;border-width:0px 0px 0px 0px;padding:1px 1px;"><font size=1 face="Verdana"><b><br>
<br>
<br>
Todd Lainhart<br>
Rational software<br>
IBM Corporation<br>
550 King Street, Littleton, MA 01460-1250</b></font><font size=1 face="Arial"><b><br>
1-978-899-4705<br>
2-276-4705 (T/L)</b></font><font size=1 color=blue face="Arial"><b><u><br>
</u></b></font><a href=mailto:lainhart@us.ibm.com><font size=1 color=blue face="Arial"><b><u>lainhart@us.ibm.com</u></b></font></a></table>
<br>
<p>
<hr><tt><font size=3><br>
specs mailing list</font></tt><tt><font size=3 color=blue><u><br>
</u></font></tt><a href=mailto:specs@lists.openid.net><tt><font size=3 color=blue><u>specs@lists.openid.net</u></font></tt></a><tt><font size=3 color=blue><u><br>
</u></font></tt><a href="http://lists.openid.net/mailman/listinfo/openid-specs"><tt><font size=3 color=blue><u>http://lists.openid.net/mailman/listinfo/openid-specs</u></font></tt></a>
<br><font size=3>_______________________________________________<br>
specs mailing list</font><font size=3 color=blue><u><br>
</u></font><a href=mailto:specs@lists.openid.net><font size=3 color=blue><u>specs@lists.openid.net</u></font></a><font size=3 color=blue><u><br>
</u></font><a href="http://lists.openid.net/mailman/listinfo/openid-specs"><font size=3 color=blue><u>http://lists.openid.net/mailman/listinfo/openid-specs</u></font></a>
<br>