Hi Pete,
On Tue, 2011-09-20 at 16:05 -0600, Pete Zaitcev wrote:
On Wed, 14 Sep 2011 19:22:00 +0100
Mark McLoughlin <markmc(a)redhat.com> wrote:
> 4) iwhd and Image Factory would be configured to only accept
> connections from Conductor - e.g. using two-legged OAuth like
> Katello does with Candlepin and Pulp
Since this was posted, I have read up on OAuth and I came up with
a question: what is a "two-legged" OAuth?
Good question :-)
I agree that "two-legged" is such a great term - it isn't much help
understanding what's going on and it doesn't appear in the RFC.
It basically refers authentication done based on just the consumer key
and secret, not an access token and secret.
i.e. you just pass the credentials that the RFC describes passed in the
request token phase of three-legged OAuth. You don't ever actually
obtain a token.
And, do you envision iwhd to be a "client" in OAuth terms,
or a
"server" (it cannot be "Jane")? It may seem ridiculous, but I built
an
imaginary scheme for both cases, and either seems to make some amount
of sense.
Right, iwhd would be a server and would authenticate the
oauth_consumer_key and oauth_signature parameters in the Authorization
header against a key and secret in its config file.
This is what pulp and candelpin do, and we'd just be replicating that.
Have you looked at liboauth? It looks like tests/oauthtest2.c does the
client side of two-legged oauth, but you should be able to use the
similar code to generate a signature and check against the supplied one?
Cheers,
Mark.