Authenticating with OAuth2?

[Cantor, Scott]

> Right. But since the OAuth2 spec says scope is optional for
> OAuth2 authorization requests, I can't really tell him that the
> library he's using violates the spec.

Sorry, but you can. This comes up in SAML a lot. It's important.

Features may be optional to *use*, but they're mandatory to implement.

We had a bug, and so does that library.

In general, scope is really required for OAuth to work safely on its own because scope was originally the substitute for "audience", it limits a token's usage.

One other point I had intended to make: what he's asking for isn't safe anyway. If you try and abuse OAuth to "just" do SSO, you'll generally have holes. OpenID is at a basic level just intended to codify usage to avoid the worst of them, so without it, you tend to end up with problems.

-- Scott