OAuth is not an Identity Protocol

Don Thibeau @4thibeau

Open Idenity Standard Wins...European Identity & Cloud Award 2013: OAuth 2.0 - 70778 - KuppingerCole: http://t.co/jXfJpT8HAh

Don Thibeau @4thibeau

Open Idenity Standard Wins...European Identity & Cloud Award 2013: OAuth 2.0 - 70778 - KuppingerCole: http://t.co/jXfJpT8HAh

Justin Richer Ⓥ @justin__richer

@4thibeau Hey, OAuth is *NOT* an identity protocol! People thinking that it is one is one of the most common misconceptions I correct.

Don Thibeau @4thibeau

@zer0n1ne please educate me

Dave Kearns @dak3

Me too how can an "authorization protocol" not be an ID protocol? RT @4thibeau @zer0n1ne please educate me

Justin Richer Ⓥ @justin__richer

@dak3 @4thibeau OAuth does authorization which has little to do with identity, identity requires authentication and profile data. (1/2)

Justin Richer Ⓥ @justin__richer

@dak3 @4thibeau See writeups from @_nat http://t.co/aHiQPXaRjk and @vibronet http://t.co/AN6wIvQzAb for more detail. (2/2)

Justin Richer Ⓥ @justin__richer

@dak3 @4thibeau Also the talk I gave at MIT this past winter covers this as well at about 14m in: http://t.co/orDYU5LKjR (3/2)

拡大

Dave Kearns @dak3

@zer0n1ne AuthZ and AuthN are two sides of the same ID coin see http://t.co/QOlH4i1Ujr @4thibeau

Justin Richer Ⓥ @justin__richer

@dak3 @4thibeau That presumes authz is binary and total, which is a flawed assumption. AuthN is just one context in which AuthZ works.

Dave Kearns @dak3

@zer0n1ne @4thibeau You didn't read ghe piece, did you?

Justin Richer Ⓥ @justin__richer

@dak3 @4thibeau ...uh, yes, I did. Did you read mine? And my point was that AuthZ can happen in contexts other than AuthN.