Authenticating with OAuth2?

[Wessel, Keith]

All very valid points. I'm going to pass these along to him. I wasn't actually comfortable with using OAuth2 for this use case, anyway, but I couldn't elaborate why. You put your finger on it.

Thank you,
Keith


-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Friday, May 31, 2024 11:30 AM
To: Shib Users <users at shibboleth.net>
Cc: Wessel, Keith <kwessel at illinois.edu>
Subject: Re: Authenticating with OAuth2?

> Right. But since the OAuth2 spec says scope is optional for
> OAuth2 authorization requests, I can't really tell him that the
> library he's using violates the spec.

Sorry, but you can. This comes up in SAML a lot. It's important.

Features may be optional to *use*, but they're mandatory to implement.

We had a bug, and so does that library.

In general, scope is really required for OAuth to work safely on its own because scope was originally the substitute for "audience", it limits a token's usage.

One other point I had intended to make: what he's asking for isn't safe anyway. If you try and abuse OAuth to "just" do SSO, you'll generally have holes. OpenID is at a basic level just intended to codify usage to avoid the worst of them, so without it, you tend to end up with problems.

-- Scott