?(Sorry for top-reply, live.com has problems with signed emails)
It's quite possible to XMPP-ize OAuth. Just took a look at the protocol
(http://tools.ietf.org/html/rfc5849). Essentially:
1. printer.example.com advertises OAuth feature (http://oauth.net/:o-auth).
2. Client selects O-AUTH and provides server/URL in a SASL-like payload
(BASE64(http="http://photos.example.com/juliet";)).
3. printer.example.com does a GET against the URL and looks for a META tag
("urn:tmp:xmpp") that contains the target XMPP server
(xmpp.tcp.photos.example.com; or photos.example.com:5252).
3.1. If the META tag is not found, printer.example.com probably comes back
with not-found.
3.2. It might even be a good idea to send a hint along in the GET request
(ACCEPT: text/html; text/html+xmpp) so that the server only sends back the
HTML and META tags.
4. printer.example.com contacts photos.example.com:5252 and requests
authorization.
5. photos.example.com sets up E2E encryption with client.
6. The request is authorized over this channel (using XEP0004).
7. photos.example.com informs printer.example.com of success.
I don't know if a XEP for (3) exists; at any rate it is immensely useful for
XMPP-izing protocols like OAuth (heck, we could even get OpenID to work the
same way as this).
Thoughts?
--------------------------------------------------
From: "Jonathan Schleifer" <[email protected]>
Sent: Sunday, December 12, 2010 2:19 PM
To: "Jabber/XMPP software development list" <[email protected]>
Subject: Re: [jdev] oAuth equivalent for for XMPP?
_______________________________________________
JDev mailing list
Forum: http://www.jabberforum.org/forumdisplay.php?f=20
Info: http://mail.jabber.org/mailman/listinfo/jdev
Unsubscribe: [email protected]
_______________________________________________
_______________________________________________
JDev mailing list
Forum: http://www.jabberforum.org/forumdisplay.php?f=20
Info: http://mail.jabber.org/mailman/listinfo/jdev
Unsubscribe: [email protected]
_______________________________________________
