On Wed, Sep 21, 2011 at 12:44:10PM -0600, Pete Zaitcev wrote:
Guys, here's a basic question: if we implement an authentication
from scratch,
as is the case in iwhd, what does 2-legged OAuth buy us that Basic would not?
It is my understanding that although Basic is quite weak, 2-legged OAuth
does not offer a protection from any new attacks, despite offering a timestamp
and nonce. It can still be replayed, if used without SSL, right? I mean, if
the replay is offered fast enough. So, why is there a tilt towards OAuth?
Is there a commonality with 3-legged OAuth that we want to exploit? Or what?
I'll let others answer the deeper technical questions, but from the
Conductor standpoint we wanted OAuth because Katello has already
standardized on it and it is very, very easy to turn on once the
correct client is installed.
I have had people tell me there are various fundamental reasons that
even 2-legged OAuth is better than Basic, but I can't enumerate them
for you.
--H
--
== Hugh Brock, hbrock(a)redhat.com ==
== Engineering Manager, Cloud BU ==
== Aeolus Project: Manage virtual infrastructure across clouds. ==
==
http://aeolusproject.org ==
"I know that you believe you understand what you think I said, but I’m
not sure you realize that what you heard is not what I meant."
--Robert McCloskey