Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > comp.lang.python > #22222 > unrolled thread

OAuth 2.0 implementation

Started byDemian Brecht <demianbrecht@gmail.com>
First post2012-03-26 19:42 -0700
Last post2012-07-07 04:58 +1000
Articles 20 on this page of 23 — 10 participants

Back to article view | Back to comp.lang.python


Contents

  OAuth 2.0 implementation Demian Brecht <demianbrecht@gmail.com> - 2012-03-26 19:42 -0700
    Re: OAuth 2.0 implementation Ben Finney <ben+python@benfinney.id.au> - 2012-03-27 14:11 +1100
      Re: OAuth 2.0 implementation Roy Smith <roy@panix.com> - 2012-03-26 23:30 -0400
        Re: OAuth 2.0 implementation Ben Finney <ben+python@benfinney.id.au> - 2012-03-27 14:49 +1100
          Re: OAuth 2.0 implementation Roy Smith <roy@panix.com> - 2012-03-26 23:57 -0400
            Re: OAuth 2.0 implementation Ben Finney <ben+python@benfinney.id.au> - 2012-03-27 15:24 +1100
              Re: OAuth 2.0 implementation Jack Diederich <jackdied@gmail.com> - 2012-03-27 01:24 -0400
              Re: OAuth 2.0 implementation Demian Brecht <demianbrecht@gmail.com> - 2012-03-26 22:30 -0700
                Re: OAuth 2.0 implementation Roy Smith <roy@panix.com> - 2012-03-27 10:18 -0400
                  Re: OAuth 2.0 implementation Demian Brecht <demianbrecht@gmail.com> - 2012-03-27 10:54 -0700
                  Re: OAuth 2.0 implementation Mark Hammond <skippy.hammond@gmail.com> - 2012-03-28 14:42 +1100
      Re: OAuth 2.0 implementation Stuart Bishop <stuart@stuartbishop.net> - 2012-03-27 16:59 +0700
      Socket Error : Address still in use  (Conveting from python 1.5.2 to 2.7.1) Wong Wah Meng-R32813 <r32813@freescale.com> - 2012-03-27 09:41 +0000
      Re: OAuth 2.0 implementation Roland Hedberg <roland@catalogix.se> - 2012-03-27 15:36 +0200
    Re: OAuth 2.0 implementation Demian Brecht <demianbrecht@gmail.com> - 2012-07-05 07:06 -0700
      Re: OAuth 2.0 implementation Alec Taylor <alec.taylor6@gmail.com> - 2012-07-06 01:19 +1000
        Re: OAuth 2.0 implementation Demian Brecht <demianbrecht@gmail.com> - 2012-07-05 10:48 -0700
        Re: OAuth 2.0 implementation Demian Brecht <demianbrecht@gmail.com> - 2012-07-05 10:48 -0700
          Re: OAuth 2.0 implementation Demian Brecht <demianbrecht@gmail.com> - 2012-07-06 08:38 -0700
          Re: OAuth 2.0 implementation Demian Brecht <demianbrecht@gmail.com> - 2012-07-06 08:38 -0700
            Re: OAuth 2.0 implementation Alec Taylor <alec.taylor6@gmail.com> - 2012-07-07 04:41 +1000
            RE: OAuth 2.0 implementation "Demian Brecht" <demianbrecht@gmail.com> - 2012-07-06 11:49 -0700
            Re: OAuth 2.0 implementation Alec Taylor <alec.taylor6@gmail.com> - 2012-07-07 04:58 +1000

Page 1 of 2  [1] 2  Next page →


#22222 — OAuth 2.0 implementation

FromDemian Brecht <demianbrecht@gmail.com>
Date2012-03-26 19:42 -0700
SubjectOAuth 2.0 implementation
Message-ID<1973354.3.1332816158529.JavaMail.geo-discussion-forums@pbae2>
Hi all,

I'm getting close to an alpha release of an OAuth 2.0 implementation (https://github.com/demianbrecht/py-sanction). High level features include:

* Support for multiple providers (protocol deviations). This didn't seem to be supported by any library.
* Actually an OAuth 2.0 implementation (python-oauth2 is a 2nd version of python-oauth, not an OAuth 2.0 implementation)
* Support for the entire OAuth 2.0 spec. Most provide support for the authorization code grant flow (employed by all web server providers), but lacked support or extensibility for any other flows, credentials or other provider extensions)
* 100% unit test coverage. Some employ TDD, others didn't.

Current implementation includes support for Authorization Code Grant flow but can be extended to support others (including extensions) quite trivially.

Current adapter implementations include:

* Google
* Facebook
* Stack Exchange
* Deviant Art
* Foursquare

It has yet to be heavily used or functionally tested (basic tests have been done in example/server.py) and documentation is being worked on.

Just wanted to share some of my work and hopefully someone other than me can find some use for it :)


P.S. For those interested, cloc stats are:

http://cloc.sourceforge.net v 1.53  T=0.5 s (28.0 files/s, 1818.0 lines/s)
-------------------------------------------------------------------------------
Language                     files          blank        comment           code
-------------------------------------------------------------------------------
Python                          14            239            196            474
-------------------------------------------------------------------------------
SUM:                            14            239            196            474
-------------------------------------------------------------------------------

[toc] | [next] | [standalone]


#22223

FromBen Finney <ben+python@benfinney.id.au>
Date2012-03-27 14:11 +1100
Message-ID<87haxahh51.fsf@benfinney.id.au>
In reply to#22222
Demian Brecht <demianbrecht@gmail.com> writes:

> I'm getting close to an alpha release of an OAuth 2.0 implementation
> (https://github.com/demianbrecht/py-sanction).

Thank you for doing this work.

As someone who uses OpenID, what can I read about why OAuth is better?

Everything I read is targeted toward either people *implementing* OAuth,
or people who use “social networking”. Nothing much for people who want
to control their own identity provider (in OpenID terms).

Is OAuth not possible without relying on “social networking” centralised
services? Can we use OAuth services without some Google or Facebook or
other gatekeeper imposing itself in the transaction?

-- 
 \       “Never use a long word when there's a commensurate diminutive |
  `\                                    available.” —Stan Kelly-Bootle |
_o__)                                                                  |
Ben Finney

[toc] | [prev] | [next] | [standalone]


#22224

FromRoy Smith <roy@panix.com>
Date2012-03-26 23:30 -0400
Message-ID<roy-E4EA5A.23301726032012@news.panix.com>
In reply to#22223
In article <87haxahh51.fsf@benfinney.id.au>,
 Ben Finney <ben+python@benfinney.id.au> wrote:

> Demian Brecht <demianbrecht@gmail.com> writes:
> 
> > I'm getting close to an alpha release of an OAuth 2.0 implementation
> > (https://github.com/demianbrecht/py-sanction).
> 
> Thank you for doing this work.
> 
> As someone who uses OpenID, what can I read about why OAuth is better?

OpenID is for people who worry about things like how OpenID is different 
from OAuth.  Oauth is for people who have no idea what OAuth is and just 
want to be able to log into web sites using their Facebook account.

[toc] | [prev] | [next] | [standalone]


#22226

FromBen Finney <ben+python@benfinney.id.au>
Date2012-03-27 14:49 +1100
Message-ID<878vimhfdp.fsf@benfinney.id.au>
In reply to#22224
Roy Smith <roy@panix.com> writes:

> In article <87haxahh51.fsf@benfinney.id.au>,
>  Ben Finney <ben+python@benfinney.id.au> wrote:
> > As someone who uses OpenID, what can I read about why OAuth is better?
>
> OpenID is for people who worry about things like how OpenID is different 
> from OAuth.  Oauth is for people who have no idea what OAuth is and just 
> want to be able to log into web sites using their Facebook account.

So, if I want to be free to choose an identity provider I trust, and
it's not Facebook or Google or Twitter or other privacy-hostile
services, how does OAuth help me do that?

What can I read for how to become an OAuth user that doesn't assume I
want a “social networking” provider involved in my identity
transactions?

-- 
 \      “It is difficult to get a man to understand something when his |
  `\   salary depends upon his not understanding it.” —Upton Sinclair, |
_o__)                                                             1935 |
Ben Finney

[toc] | [prev] | [next] | [standalone]


#22227

FromRoy Smith <roy@panix.com>
Date2012-03-26 23:57 -0400
Message-ID<roy-2E9CB1.23571326032012@news.panix.com>
In reply to#22226
In article <878vimhfdp.fsf@benfinney.id.au>,
 Ben Finney <ben+python@benfinney.id.au> wrote:

> Roy Smith <roy@panix.com> writes:
> 
> > In article <87haxahh51.fsf@benfinney.id.au>,
> >  Ben Finney <ben+python@benfinney.id.au> wrote:
> > > As someone who uses OpenID, what can I read about why OAuth is better?
> >
> > OpenID is for people who worry about things like how OpenID is different 
> > from OAuth.  Oauth is for people who have no idea what OAuth is and just 
> > want to be able to log into web sites using their Facebook account.
> 
> So, if I want to be free to choose an identity provider I trust, and
> it's not Facebook or Google or Twitter or other privacy-hostile
> services, how does OAuth help me do that?

It doesn't.  Well, in theory, it could, but in practice everybody's 
OAuth implementation is different enough that they don't interoperate.

[toc] | [prev] | [next] | [standalone]


#22228

FromBen Finney <ben+python@benfinney.id.au>
Date2012-03-27 15:24 +1100
Message-ID<87zkb2fz7g.fsf@benfinney.id.au>
In reply to#22227
Roy Smith <roy@panix.com> writes:

> In article <878vimhfdp.fsf@benfinney.id.au>,
>  Ben Finney <ben+python@benfinney.id.au> wrote:
> > So, if I want to be free to choose an identity provider I trust, and
> > it's not Facebook or Google or Twitter or other privacy-hostile
> > services, how does OAuth help me do that?
>
> It doesn't.  Well, in theory, it could, but in practice everybody's 
> OAuth implementation is different enough that they don't interoperate.

Thanks. So OAuth is a pseudo-standard that is implemented incompatibly
to the extent that it doesn't actually give users the freedom to migrate
their existing data and identity at will to any other OAuth implementor?

-- 
 \         “Money is always to be found when men are to be sent to the |
  `\   frontiers to be destroyed: when the object is to preserve them, |
_o__)     it is no longer so.” —Voltaire, _Dictionnaire Philosophique_ |
Ben Finney

[toc] | [prev] | [next] | [standalone]


#22230

FromJack Diederich <jackdied@gmail.com>
Date2012-03-27 01:24 -0400
Message-ID<mailman.1029.1332825858.3037.python-list@python.org>
In reply to#22228
On Tue, Mar 27, 2012 at 12:24 AM, Ben Finney <ben+python@benfinney.id.au> wrote:
> Roy Smith <roy@panix.com> writes:
>
>> In article <878vimhfdp.fsf@benfinney.id.au>,
>>  Ben Finney <ben+python@benfinney.id.au> wrote:
>> > So, if I want to be free to choose an identity provider I trust, and
>> > it's not Facebook or Google or Twitter or other privacy-hostile
>> > services, how does OAuth help me do that?
>>
>> It doesn't.  Well, in theory, it could, but in practice everybody's
>> OAuth implementation is different enough that they don't interoperate.
>
> Thanks. So OAuth is a pseudo-standard that is implemented incompatibly
> to the extent that it doesn't actually give users the freedom to migrate
> their existing data and identity at will to any other OAuth implementor?

Pretty much.  It is nice that it is published as a standard at all but
the standard is just whatever people are actually doing.  It seems
less hostile when you think of it as vigorous documentation instead of
protocols set in stone.

-Jack

[toc] | [prev] | [next] | [standalone]


#22231

FromDemian Brecht <demianbrecht@gmail.com>
Date2012-03-26 22:30 -0700
Message-ID<7909491.0.1332826232743.JavaMail.geo-discussion-forums@pbim5>
In reply to#22228
On Monday, 26 March 2012 21:24:35 UTC-7, Ben Finney  wrote:
> Roy Smith <roy@panix.com> writes:
> 
> > In article <878vimhfdp.fsf@benfinney.id.au>,
> >  Ben Finney <ben+python@benfinney.id.au> wrote:
> > > So, if I want to be free to choose an identity provider I trust, and
> > > it's not Facebook or Google or Twitter or other privacy-hostile
> > > services, how does OAuth help me do that?
> >
> > It doesn't.  Well, in theory, it could, but in practice everybody's 
> > OAuth implementation is different enough that they don't interoperate.
> 
> Thanks. So OAuth is a pseudo-standard that is implemented incompatibly
> to the extent that it doesn't actually give users the freedom to migrate
> their existing data and identity at will to any other OAuth implementor?
> 
> -- 
>  \         “Money is always to be found when men are to be sent to the |
>   `\   frontiers to be destroyed: when the object is to preserve them, |
> _o__)     it is no longer so.” —Voltaire, _Dictionnaire Philosophique_ |
> Ben Finney

OAuth 2.0 is the emerging standard (now passed on to IETF) to deal with providing access to protected resources. OpenID is a standard used to deal with authentication. While there is some overlap (OAuth can be used for authentication as well), the goals of the two protocols are different.

OAuth 2.0 is still in draft status (draft 25 is the current one I believe) and yes, unfortunately every single server available at this point have varying degrees of separation from the actual spec. It's not a pseudo-standard, it's just not observed to the letter. Google is the closest and Facebook seems to be the farthest away (Stack Exchange is in close second due to building theirs to work like Facebook's). That was pretty much how this work was born. I wanted to be able to implement authentication and resource access over multiple providers with a single code base.

So, in answer to your questions:

1) If you're only looking for a solution to authentication, OAuth is no better than OpenID. Having said that, with the apparent popularity of OAuth 2.0, more providers may support OAuth than will OpenID (however, that's just my assumption).

2) OAuth is all about centralized services in that it is how providers allow access to protected resources. Whether it's a social network or SaaS (such as Harvest: http://www.getharvest.com/), if there isn't exposure to protected resources, then OAuth becomes pointless.

3) If you're looking to implement OAuth authentication with a provider that you trust, grab the sanction source, implement said provider and send a pull request ;)

4) Data migration doesn't happen with OAuth. As the intent is to allow access to protected resources, migrating Google to say, Facebook just wouldn't happen :)

Hope that makes sense and answers your questions.
- Demian

[toc] | [prev] | [next] | [standalone]


#22247

FromRoy Smith <roy@panix.com>
Date2012-03-27 10:18 -0400
Message-ID<roy-261DBC.10182627032012@news.panix.com>
In reply to#22231
In article 
<7909491.0.1332826232743.JavaMail.geo-discussion-forums@pbim5>,
 Demian Brecht <demianbrecht@gmail.com> wrote:

> OAuth 2.0 is still in draft status (draft 25 is the current one I believe) 
> and yes, unfortunately every single server available at this point have 
> varying degrees of separation from the actual spec. It's not a 
> pseudo-standard, it's just not observed to the letter. Google is the closest 
> and Facebook seems to be the farthest away (Stack Exchange is in close second 
> due to building theirs to work like Facebook's).

In practice, OAuth is all about getting your site to work with Facebook.  
That is all most web sites care about today because that's where the 
money is.  The fact that other sites also use OAuth is of mostly 
academic interest at this point.

The next player on the list is Twitter, and they're not even up to using 
their own incompatible version of OAuth 2.0.  They're still using OAuth 
1.0 (although, I understand, they're marching towards 2.0).

[toc] | [prev] | [next] | [standalone]


#22252

FromDemian Brecht <demianbrecht@gmail.com>
Date2012-03-27 10:54 -0700
Message-ID<23005482.975.1332870880211.JavaMail.geo-discussion-forums@pbcr5>
In reply to#22247
On Tuesday, 27 March 2012 07:18:26 UTC-7, Roy Smith  wrote:
> In article 
> <7909491.0.1332826232743.JavaMail.geo-discussion-forums@pbim5>,
>  Demian Brecht <demianbrecht@gmail.com> wrote:
> 
> > OAuth 2.0 is still in draft status (draft 25 is the current one I believe) 
> > and yes, unfortunately every single server available at this point have 
> > varying degrees of separation from the actual spec. It's not a 
> > pseudo-standard, it's just not observed to the letter. Google is the closest 
> > and Facebook seems to be the farthest away (Stack Exchange is in close second 
> > due to building theirs to work like Facebook's).
> 
> In practice, OAuth is all about getting your site to work with Facebook.  
> That is all most web sites care about today because that's where the 
> money is.  The fact that other sites also use OAuth is of mostly 
> academic interest at this point.
> 
> The next player on the list is Twitter, and they're not even up to using 
> their own incompatible version of OAuth 2.0.  They're still using OAuth 
> 1.0 (although, I understand, they're marching towards 2.0).

Sure, with the initial surge of the Facebook platform, I'm sure there are many more applications that only work with Facebook. However, after the initial gold rush, I'm sure there will be more developers who see the potential power of service aggregation (and not just for feeds ;)). I know I'm one of them.

Of course, a lot of these thoughts are around niche markets, but isn't that where the money is? Untapped, niche markets? That's a completely different discussion though and would obviously be quite the thread derailment.

[toc] | [prev] | [next] | [standalone]


#22264

FromMark Hammond <skippy.hammond@gmail.com>
Date2012-03-28 14:42 +1100
Message-ID<mailman.1063.1332920361.3037.python-list@python.org>
In reply to#22247
On 28/03/2012 1:18 AM, Roy Smith wrote:
> In article
> <7909491.0.1332826232743.JavaMail.geo-discussion-forums@pbim5>,
>   Demian Brecht <demianbrecht@gmail.com> wrote:
>
>> OAuth 2.0 is still in draft status (draft 25 is the current one I believe)
>> and yes, unfortunately every single server available at this point have
>> varying degrees of separation from the actual spec. It's not a
>> pseudo-standard, it's just not observed to the letter. Google is the closest
>> and Facebook seems to be the farthest away (Stack Exchange is in close second
>> due to building theirs to work like Facebook's).
>
> In practice, OAuth is all about getting your site to work with Facebook.
> That is all most web sites care about today because that's where the
> money is.  The fact that other sites also use OAuth is of mostly
> academic interest at this point.
>
> The next player on the list is Twitter, and they're not even up to using
> their own incompatible version of OAuth 2.0.  They're still using OAuth
> 1.0 (although, I understand, they're marching towards 2.0).

Almost all "social" or "sharing" sites implement OAuth - either 1.0 or 
2.0.  Facebook is clearly the big winner here but not the only player. 
It's also used extensively by google (eg, even their SMTP server 
supports using OAuth credentials to send email)

I'd go even further - most sites which expose an API use OAuth for 
credentials with that API.

Mark

[toc] | [prev] | [next] | [standalone]


#22234

FromStuart Bishop <stuart@stuartbishop.net>
Date2012-03-27 16:59 +0700
Message-ID<mailman.1034.1332842368.3037.python-list@python.org>
In reply to#22223
On Tue, Mar 27, 2012 at 10:11 AM, Ben Finney <ben+python@benfinney.id.au> wrote:
> Demian Brecht <demianbrecht@gmail.com> writes:
>
>> I'm getting close to an alpha release of an OAuth 2.0 implementation
>> (https://github.com/demianbrecht/py-sanction).
>
> Thank you for doing this work.
>
> As someone who uses OpenID, what can I read about why OAuth is better?

They are different, and often you need to use both.

OpenID allows web sites to authenticate someone. It is not really
useful for anything not an interactive web site. The consuming site
never gets your keys, it just gets confirmation from the provider that
the user is who they claim they are and maybe some details that the
provider chooses to provide such as an email address.

OAuth is for generating authentication keys that allow a program to
authenticate as someone and perform operations on their behalf. You
use OAuth to generate a key so that Foursquare can send messages via
Twitter on your behalf, or so the Facebook client on your phone can
access your account without storing your password. You also get
authentication here, as you can't generate a key without being
authenticated, but the real reason it is used instead of OpenID is so
you can keep the key and keep using it to act as the user; you can
keep using that key until it expires or it is revoked.

Authentication providers that don't provide a webapi just implement
OpenID. Big sites like Google and Facebook implement both OpenID (for
'log in with your GMail account') and OAuth ('post this message to
your Facebook wall').

-- 
Stuart Bishop <stuart@stuartbishop.net>
http://www.stuartbishop.net/

[toc] | [prev] | [next] | [standalone]


#22235 — Socket Error : Address still in use (Conveting from python 1.5.2 to 2.7.1)

FromWong Wah Meng-R32813 <r32813@freescale.com>
Date2012-03-27 09:41 +0000
SubjectSocket Error : Address still in use (Conveting from python 1.5.2 to 2.7.1)
Message-ID<mailman.1035.1332845840.3037.python-list@python.org>
In reply to#22223
Hello there,

I am in the midst of converting my application from python 1.5.2 to python 2.7.1 on HP-UX 11 Itanium box. 

My application server will set a listening port, accepting request from multiple clients. The code just works fine in the old python environment. E.g. when I do a lsof | grep <listening port> I got the following.

python     62602  genasm    5u  IPv4 0x7350d1f0        0t0  TCP zmy02aix02:12121 (LISTEN)
python     62602  genasm    6u  IPv4 0x744fb5f0        0t0  TCP zmy02aix02:12121->zmy02aix02-bkup:51867 (ESTABLISHED)
python     62602  genasm    7u  IPv4 0x75b959f0        0t0  TCP zmy02aix02:12121->zmy02aix02-bkup:51869 (ESTABLISHED)
python     62602  genasm    8u  IPv4 0x75a559f0        0t0  TCP zmy02aix02:12121->zmy02aix02-bkup:51873 (ESTABLISHED)

Strange things happened in python 2.7.1. Without modifying the code of how the socket was created and how the TCP/IP address was bound to the socket, it seems that every other processes that I run, which supposed to connect to the listening port as a client program, also appears to be holding a listening port. This is weird. Anyone has encountered this before especially when you were converting from an old python to a new python? Like you can see below there are 5 processes hosting the listening port of 18882.

$ lsof -i tcp | grep 18882
python  10598 r32813    3u  IPv4 0xe00000050b73e400       0t0  TCP zmy02hp3.ap.freescale.net:18882 (LISTEN)
python  18181 r32813    3u  IPv4 0xe00000050b73e400       0t0  TCP zmy02hp3.ap.freescale.net:18882 (LISTEN)
python  20025 r32813    3u  IPv4 0xe00000050b73e400       0t0  TCP zmy02hp3.ap.freescale.net:18882 (LISTEN)
python  26295 r32813    3u  IPv4 0xe00000050b73e400       0t0  TCP zmy02hp3.ap.freescale.net:18882 (LISTEN)
python  26428 r32813    3u  IPv4 0xe00000050b73e400       0t0  TCP zmy02hp3.ap.freescale.net:18882 (LISTEN)

Since only one of them is the genuine process holding the port, I need to kill off the rest of the process if I need to restart the genuine process running under that port. It should not work this way. 

Here is the code of the application process that hosts the listening port. 

	self.sock = socket.socket( socket.AF_INET, socket.SOCK_STREAM )
	self.sock.setsockopt( socket.SOL_SOCKET, socket.SO_REUSEADDR, 1 )
	self.sock.setsockopt( socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1
	self.sock.setsockopt( socket.IPPROTO_TCP, _TCP_NODELAY, 1 )
	self.sock.bind( self.server_address )
  

Here is the client code that does the connection.

       self.sock = socket.socket( socket.AF_INET, socket.SOCK_STREAM )
       self.sock.setsockopt( socket.IPPROTO_TCP, _TCP_NODELAY, 1 )
       self.sock.connect( self.server_address )

Regards,
Wah Meng

[toc] | [prev] | [next] | [standalone]


#22242

FromRoland Hedberg <roland@catalogix.se>
Date2012-03-27 15:36 +0200
Message-ID<mailman.1038.1332855391.3037.python-list@python.org>
In reply to#22223
And then to complicate the picture you have OpenID Connect which is an attempt at
bringing OpenID and OAuth2.0 together.

By the way I have an implementation of OpenID Connect here:

https://github.com/rohe/pyoidc

-- Roland

27 mar 2012 kl. 11:59 skrev Stuart Bishop:

> On Tue, Mar 27, 2012 at 10:11 AM, Ben Finney <ben+python@benfinney.id.au> wrote:
>> Demian Brecht <demianbrecht@gmail.com> writes:
>> 
>>> I'm getting close to an alpha release of an OAuth 2.0 implementation
>>> (https://github.com/demianbrecht/py-sanction).
>> 
>> Thank you for doing this work.
>> 
>> As someone who uses OpenID, what can I read about why OAuth is better?
> 
> They are different, and often you need to use both.
> 
> OpenID allows web sites to authenticate someone. It is not really
> useful for anything not an interactive web site. The consuming site
> never gets your keys, it just gets confirmation from the provider that
> the user is who they claim they are and maybe some details that the
> provider chooses to provide such as an email address.
> 
> OAuth is for generating authentication keys that allow a program to
> authenticate as someone and perform operations on their behalf. You
> use OAuth to generate a key so that Foursquare can send messages via
> Twitter on your behalf, or so the Facebook client on your phone can
> access your account without storing your password. You also get
> authentication here, as you can't generate a key without being
> authenticated, but the real reason it is used instead of OpenID is so
> you can keep the key and keep using it to act as the user; you can
> keep using that key until it expires or it is revoked.
> 
> Authentication providers that don't provide a webapi just implement
> OpenID. Big sites like Google and Facebook implement both OpenID (for
> 'log in with your GMail account') and OAuth ('post this message to
> your Facebook wall').
> 
> -- 
> Stuart Bishop <stuart@stuartbishop.net>
> http://www.stuartbishop.net/
> -- 
> http://mail.python.org/mailman/listinfo/python-list

Roland

-----------------------------------------------------------
With anchovies there is no common ground 
-- Nero Wolfe

[toc] | [prev] | [next] | [standalone]


#24918

FromDemian Brecht <demianbrecht@gmail.com>
Date2012-07-05 07:06 -0700
Message-ID<3e023dd6-eb7d-4a7a-b868-bd41d7c69c8b@googlegroups.com>
In reply to#22222
FWIW, this package has undergone a major overhaul (474 LOC down to much happier 66) and is available at https://github.com/demianbrecht/sanction. Also available from PyPI.

[toc] | [prev] | [next] | [standalone]


#24927

FromAlec Taylor <alec.taylor6@gmail.com>
Date2012-07-06 01:19 +1000
Message-ID<mailman.1831.1341501584.4697.python-list@python.org>
In reply to#24918
On Fri, Jul 6, 2012 at 12:06 AM, Demian Brecht <demianbrecht@gmail.com> wrote:
> FWIW, this package has undergone a major overhaul (474 LOC down to much happier 66) and is available at https://github.com/demianbrecht/sanction. Also available from PyPI.

Thanks for this, I've now shared it on my favourite web-framework
(which unfortunately recommends Janrain) as an alternative:
https://groups.google.com/forum/#!topic/web2py/XjUEewfP5Xg

[toc] | [prev] | [next] | [standalone]


#24939

FromDemian Brecht <demianbrecht@gmail.com>
Date2012-07-05 10:48 -0700
Message-ID<mailman.1840.1341510517.4697.python-list@python.org>
In reply to#24927
On Thursday, 5 July 2012 08:19:41 UTC-7, Alec Taylor  wrote:
> On Fri, Jul 6, 2012 at 12:06 AM, Demian Brecht <demianbrecht@gmail.com> wrote:
> > FWIW, this package has undergone a major overhaul (474 LOC down to much happier 66) and is available at https://github.com/demianbrecht/sanction. Also available from PyPI.
> 
> Thanks for this, I've now shared it on my favourite web-framework
> (which unfortunately recommends Janrain) as an alternative:
> https://groups.google.com/forum/#!topic/web2py/XjUEewfP5Xg

No worries, thanks for the interest :)

[toc] | [prev] | [next] | [standalone]


#24941

FromDemian Brecht <demianbrecht@gmail.com>
Date2012-07-05 10:48 -0700
Message-ID<7f8f94b6-ed63-41ce-8180-83ca96d88ea3@googlegroups.com>
In reply to#24927
On Thursday, 5 July 2012 08:19:41 UTC-7, Alec Taylor  wrote:
> On Fri, Jul 6, 2012 at 12:06 AM, Demian Brecht <demianbrecht@gmail.com> wrote:
> > FWIW, this package has undergone a major overhaul (474 LOC down to much happier 66) and is available at https://github.com/demianbrecht/sanction. Also available from PyPI.
> 
> Thanks for this, I've now shared it on my favourite web-framework
> (which unfortunately recommends Janrain) as an alternative:
> https://groups.google.com/forum/#!topic/web2py/XjUEewfP5Xg

No worries, thanks for the interest :)

[toc] | [prev] | [next] | [standalone]


#24972

FromDemian Brecht <demianbrecht@gmail.com>
Date2012-07-06 08:38 -0700
Message-ID<mailman.1862.1341589137.4697.python-list@python.org>
In reply to#24941
Supported provider list (with example code) is now:
* Facebook
* Google
* Foursquare
* bitly
* GitHub
* StackExchange
* Instagram

Other providers may also be supported out of the box, but have been untested thus far.

[toc] | [prev] | [next] | [standalone]


#24973

FromDemian Brecht <demianbrecht@gmail.com>
Date2012-07-06 08:38 -0700
Message-ID<5b061fbe-71eb-43c3-b8e9-ce5b02a9cce7@googlegroups.com>
In reply to#24941
Supported provider list (with example code) is now:
* Facebook
* Google
* Foursquare
* bitly
* GitHub
* StackExchange
* Instagram

Other providers may also be supported out of the box, but have been untested thus far.

[toc] | [prev] | [next] | [standalone]


Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.lang.python


csiph-web