Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder1.news.weretis.net!feeder.erje.net!newsfeed.xs4all.nl!newsfeed6.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail
Subject: Re: OAuth 2.0 implementation
Mime-Version: 1.0 (Apple Message framework v1257)
Content-Type: text/plain; charset=us-ascii
From: Roland Hedberg <roland@catalogix.se>
In-Reply-To: <CADmi=6P56GZwDqJn-LbQneLTJwAboFPHQSAZXXs6j8fB8pMWwA@mail.gmail.com>
Date: Tue, 27 Mar 2012 15:36:22 +0200
Content-Transfer-Encoding: quoted-printable
References: <1973354.3.1332816158529.JavaMail.geo-discussion-forums@pbae2> <87haxahh51.fsf@benfinney.id.au> <CADmi=6P56GZwDqJn-LbQneLTJwAboFPHQSAZXXs6j8fB8pMWwA@mail.gmail.com>
To: Stuart Bishop <stuart@stuartbishop.net>
Cc: python-list@python.org, Ben Finney <ben+python@benfinney.id.au>
Precedence: list
Newsgroups: comp.lang.python
Message-ID: <mailman.1038.1332855391.3037.python-list@python.org>
Lines: 59
NNTP-Posting-Host: 2001:888:2000:d::a6
Xref: csiph.com comp.lang.python:22242

And then to complicate the picture you have OpenID Connect which is an =
attempt at
bringing OpenID and OAuth2.0 together.

By the way I have an implementation of OpenID Connect here:

https://github.com/rohe/pyoidc

-- Roland

27 mar 2012 kl. 11:59 skrev Stuart Bishop:

> On Tue, Mar 27, 2012 at 10:11 AM, Ben Finney =
<ben+python@benfinney.id.au> wrote:
>> Demian Brecht <demianbrecht@gmail.com> writes:
>>=20
>>> I'm getting close to an alpha release of an OAuth 2.0 implementation
>>> (https://github.com/demianbrecht/py-sanction).
>>=20
>> Thank you for doing this work.
>>=20
>> As someone who uses OpenID, what can I read about why OAuth is =
better?
>=20
> They are different, and often you need to use both.
>=20
> OpenID allows web sites to authenticate someone. It is not really
> useful for anything not an interactive web site. The consuming site
> never gets your keys, it just gets confirmation from the provider that
> the user is who they claim they are and maybe some details that the
> provider chooses to provide such as an email address.
>=20
> OAuth is for generating authentication keys that allow a program to
> authenticate as someone and perform operations on their behalf. You
> use OAuth to generate a key so that Foursquare can send messages via
> Twitter on your behalf, or so the Facebook client on your phone can
> access your account without storing your password. You also get
> authentication here, as you can't generate a key without being
> authenticated, but the real reason it is used instead of OpenID is so
> you can keep the key and keep using it to act as the user; you can
> keep using that key until it expires or it is revoked.
>=20
> Authentication providers that don't provide a webapi just implement
> OpenID. Big sites like Google and Facebook implement both OpenID (for
> 'log in with your GMail account') and OAuth ('post this message to
> your Facebook wall').
>=20
> --=20
> Stuart Bishop <stuart@stuartbishop.net>
> http://www.stuartbishop.net/
> --=20
> http://mail.python.org/mailman/listinfo/python-list

Roland

-----------------------------------------------------------
With anchovies there is no common ground=20
-- Nero Wolfe