Bryan Kearney wrote:
On 09/15/2011 11:30 AM, Jim Meyering wrote:
> Mark McLoughlin wrote:
> ...
>> Here's what I managed to get from looking at Katello's usage of OAuth
>> for similar purposes.
>
> Hi Mark,
> Thanks for the survey and references.
>
>> * Despite all the dire warnings of OAuth 1.0 being a terrible protocol,
>> that does appear to be what we're using:
>>
>>
http://tools.ietf.org/html/rfc5849
>
> Can anyone give us an ETA for a Katello update to OAuth 2.0?
We seem to be ok with what we have in place now. What would drive the
change to 2.0?
Hi Bryan,
All of iwhd's regression tests rely on being able to use curl to exercise
its API. With OAuth 2.0, we could continue to do that, but not with
OAuth 1.x, according to the little I've read, e.g., in this year-old
description:
http://hueniverse.com/2010/05/introducing-oauth-2-0/:
Bearer tokens
OAuth 2.0 provides a cryptography-free option for authentication which
is based on existing cookie authentication architecture. Instead of
sending signed requests using HMAC and token secrets, the token itself
is used as a secret sent over HTTPS. This allows making API calls using
cURL and other simple scripting tools without having to canonicalize the
request and sign it.
Of course, we could have separate modes, "real life with OAuth 1.0" and
something supposedly equivalent, but without OAuth, that we would test.
But we know how that can go...