Adam, In your use case, how does AS request user re-authentication? In OAuth the user agent is redirected back to the Client after the user has authorized the client. The AS is a web server and cannot initiate a call to the user agent. I assume that the request to re-authenticate comes in a response from RS to the Client, and then the Client in a response to the user agent re-directs the user agent back to the AS for another round of authentication and authorization. Is this correct? I would like to learn more about your use case. Do you have a pointer to a description?
Zachary -------- Original Message -------- Subject: [OAUTH-WG] prompt parameter for Authorization Request Date: Thu, 13 Sep 2012 20:36:13 +0000 From: Lewis Adam-CAL022 <[email protected]><mailto:[email protected]> To: [email protected]<mailto:[email protected]> <[email protected]><mailto:[email protected]> Hi, OpenID Connect defines a parameter for the Authorization Request that I really like a lot, the prompt parameter which can force the AS to re-challenge the user for primary authentication. This would be a nice feature to have for OAuth too. I have some high assurance use cases where my resource servers will require a certain "freshness" of the access token. The RS will only accept a AT within a certain lifetime (say for example 1hr). If a client presents an AT to the RS that was minted over 1hr ago, the RS (via its RESTful API) will return an error message indicating such to the client. Further, the RS requires explicit re-authentication of the end user (by the AS) to obtain a new token. However, if the UA still has an active session with the AS, the AS will not know to re-prompt for primary auth. Hence having a PROMPT parameter in OAuth would be ideal. Obviously, the train has left the station in terms of the core draft. But I'm wondering if anybody else has come across such use cases before? Tx adam
_______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
