Open Natim opened 8 years ago
Fundamentally the challenge is that OAuth is designed as an authorization protocol. You can build an authentication protocol on top, but you have to be careful to get the details right (like OIDC). For details see http://oauth.net/articles/authentication/ by @jricher.
FWIW @ptgamr did https://github.com/ptgamr/kinto-github-token ;)
As @jmandel described in his comment on the tutorial
Using Github Bearer Token to authenticate directly to Kinto without any specific scoping of the Bearer Token means that any application having a Github Bearer Token for the user can manage, read, add and delete her Kinto data. This is not acceptable for production use.
This remembers me a discussion we had a month ago in London with @michielbdejong where he explained me that RemoteStorage embedded an OpenID Connect compatible server in charge of generating RemoteStorage scoped specific Bearer Token.
How should we handle this for Kinto, what is the plan forward to have a better OAuth2 integration.
Thoughts?