iwhd security

Jim Meyering jim at meyering.net
Thu Sep 15 20:33:26 UTC 2011


Bryan Kearney wrote:

> On 09/15/2011 11:30 AM, Jim Meyering wrote:
>> Mark McLoughlin wrote:
>> ...
>>> Here's what I managed to get from looking at Katello's usage of OAuth
>>> for similar purposes.
>>
>> Hi Mark,
>> Thanks for the survey and references.
>>
>>>   * Despite all the dire warnings of OAuth 1.0 being a terrible protocol,
>>>     that does appear to be what we're using:
>>>
>>>      http://tools.ietf.org/html/rfc5849
>>
>> Can anyone give us an ETA for a Katello update to OAuth 2.0?
>
>
> We seem to be ok with what we have in place now. What would drive the
> change to 2.0?

Hi Bryan,

All of iwhd's regression tests rely on being able to use curl to exercise
its API.  With OAuth 2.0, we could continue to do that, but not with
OAuth 1.x, according to the little I've read, e.g., in this year-old
description: http://hueniverse.com/2010/05/introducing-oauth-2-0/:

    Bearer tokens

    OAuth 2.0 provides a cryptography-free option for authentication which
    is based on existing cookie authentication architecture. Instead of
    sending signed requests using HMAC and token secrets, the token itself
    is used as a secret sent over HTTPS. This allows making API calls using
    cURL and other simple scripting tools without having to canonicalize the
    request and sign it.

Of course, we could have separate modes, "real life with OAuth 1.0" and
something supposedly equivalent, but without OAuth, that we would test.
But we know how that can go...


More information about the iwhd-devel mailing list