OAuth

DATE and TIME: Thursday, May 26, 2011, 11am

CONVENER: RL "Bob" Morgan

SCRIBE: Jim Basney

# of ATTENDEES: 23

MAIN ISSUES DISCUSSED (include as much detail as you want):
- What is OAuth? A "valet" key protocol. Use case: make photographs available to photo printing site w/o giving printing site my u/p for photo storage site.
- Where is OAuth now? Refactoring design for OAuth 2.0.
- Possible use case: internship site asking for access to student's "major" attribute.
- Use case: authentication of mobile apps. Mobile app login to Shibboleth protected uPortal. Want a long-lived token in this case. Many choices of tokens (cookies, JSON, SAML bearer). Also looking at SAML ECP for this at OSU.
- Use case: application-to-application linking ("deployed application"). Link your Twitter client with your Twitter account.
- CAS OAuth support: We'd like to know more. Implementation is "not there yet." CAS 4 will fully support OAuth and OpenID.
- How does IdP manage trusted SPs/RPs? CAS has a service registry.
- U Washington work on application access using OAuth for sharing information from learning management system, rather than using client certificates - perceived to be easier for developers. Concern about sacrificing security for ease of development.
- Example: TeraGrid/CILogon work using OAuth for science gateways.

ACTIVITIES GOING FORWARD / NEXT STEPS
- Look forward to CAS OAuth support.
- Look forward to finalization of OAuth 2.0 and stabilization of the OAuth protocol.
- Gain more experience using OAuth with apps.
If slides are used in the session, please ask presenters to convert their slides to PDF and email them to SteveO@internet2.edu

Thank you!