Closed mmccool closed 2 years ago
Action: Create a PR to re-introduce a "full" OAuth2 security scheme back into the TD spec.
Notes:
Just a couple of comments about oAuth2.0 code flow. As far as I understand the protocol, it requires user (human) interaction; therefore it is not feasible during a device to device communication (unless a human triggers this interaction? How to handle this scenario?). However, in eclipse/thingweb.node-wot#201 I pinpointed other two use cases where the user interacts through node-wot client with the device.
Finally, another flow that is worth to mention and it is quite well spread is the device extension flow. It still requires human intervention though.
This issue can be closed now, we have reviewed the flows and decided to only allow "code" and "client" from the standard flows in TD 1.1, and also added "device". However, "password" and "implicit" are deprecated and not considered secure, so we are not including built-in support for them (they can however be used via an extension.)
Full OAuth2 was removed from the last TD spec due to a lack of implementations. However, it is important, and a full implementation is necessary for consistency with other standards. So we should re-introduce it... and get two implementations done. One of those should certainly be node-wot; we should discuss another. We probably should also define "features" as "OAuth2 flows" for test and validation purposes.l
It happens to also be important for some PoCs that are in progress.