Re:OAuth 2.0 Security Best Current Practice
by jcranmer on Tuesday May 05, 2020 @05:25PM
(#23085262)
When I was looking up the OAUTHBEARER draft, there's a (OPTIONAL) field in the error response to point to the openid-configuration for dynamic registration. At the time I was implementing things for Thunderbird, no one was using this yet, and I would be surprised if this has actually been implemented by any major provider in any sort of usable way for clients.
[ Parent
| on HN ]
Re:OAuth 2.0 Security Best Current Practice
by ecnahc515 on Tuesday May 12, 2020 @07:44PM
(#23161522)
Yeah no one uses it because they explicitly want you to authenticate to register the clients on the users behalf so they can lock you out if you abuse it. It's annoying, but it makes sense. Otherwise an abuser can just dynamically create new clients anytime their existing clientID is banned.
Re:OAuth 2.0 Security Best Current Practice
by Sandhose on Wednesday May 06, 2020 @04:41AM
(#23089014)
Did you end up implementing it in Thunderbird?
We're looking to do that at my company and I'm currently implementing OAUTHBEARER in cyrus-sasl (which then could be used in cyrus-imapd & postfix)
Re:OAuth 2.0 Security Best Current Practice
by jcranmer on Wednesday May 06, 2020 @12:23PM
(#23092852)
I haven't implemented it myself, and as far as I'm aware, it hasn't been in the past few years. If it is going into cyrus-sasl, then I can probably put together containers for testing (which is on my work todo list anyways).