1. The document discusses the OAuth protocol which allows secure authorization for consumers to access user data from service providers without having to share the user's credentials. 2. OAuth uses a three-step process where a consumer first requests a request token, then directs the user to authorize access, and finally exchanges the request token for an access token to access the user's data on the service provider. 3. The document provides details on OAuth parameters, signing requests, security considerations, and implementing OAuth for mobile and XMPP applications. It emphasizes that OAuth allows integration of services while maintaining user control over authorization and access to their data.

1. Integrating services with
Luca Mearelli
Web2Expo - Berlin 2008

2. Web 2.0 means
sharing data,
through API

3. Users want to
access their data
using many services

4. Developers want to
satisfy their users
(and make it easy for them)

5. Service providers need to
keep their users data secure

6. welcome
the password antipattern

10. Image from http://www.codinghorror.com/blog/archives/001072.html

11. Passwords are precious

12. Stop asking them
Stop the antipattern

13. How to delegate access?

14. Your valet key for the web

15. a play in 3 acts
(to exchange authorization)

16. Actors on the scene
User
Consumer
Service Provider

17. Prologue
Where the Consumer presents
himself to the Service Provider

18. Consumer (to Service Provider):
here i am, this is what i do

19. consumer service provider
Consumer key
Consumer secret

21. First act
Where the Consumer obtains
an unauthorized Request Token

22. Consumer (to Service Provider):
give me a request token

23. consumer service provider
oauth_consumer_key
oauth_signature_method
oauth_signature
oauth_timestamp
oauth_nonce
oauth_version (optional)
[additional parameters]

24. Service Provider (to consumer):
here is the request token
(you can use it only once!)

25. service provider consumer
oauth_token (request token)
oauth_token_secret
[additional parameters]

27. Second act
Where the User authorizes
the Request Token

28. Consumer (to the User):
Please go to the Service Provider
and authorize this request

29. consumer user service provider
oauth_token (request token)
oauth_callback
[additional parameters]

30. Service Provider (to the User):
Do you authorize consumer
to access your data?

32. User (to the Service Provider):
YES!
(or maybe NO :-) )

33. Service Provider (to the User):
You can go back to the consumer

34. service providerservice provider
user user consumer
oauth_token (request token)

35. Third act
Where the Consumer exchanges
the Request Token
for an Access Token

36. Consumer (to the Service Provider):
Please give me the acces token
for the user

37. consumer service provider
oauth_consumer_key
oauth_token (request token)
oauth_signature_method
oauth_signature
oauth_timestamp
oauth_nonce
oauth_version (optional)

38. Service Provider (to the Consumer):
here is the access token for the user

39. service provider consumer
oauth_token (access token)
oauth_token_secret
[additional parameters]

41. Epilogue
Where the consumer
accesses the resources

42. Consumer (to the Service Provider):
Here i am again
on behalf of the user

43. consumer service provider
oauth_consumer_key
oauth_token (access token)
oauth_signature_method
oauth_signature
oauth_timestamp
oauth_nonce
oauth_version (optional)
[additional parameters]

45. The details...

46. OAuth parameters exchange
HTTP Authorization header
HTTP Post body
URL query parameters

47. Request signing algorithm
PLAINTEXT
HMAC-SHA1
RSA-SHA1

48. Signature base string
a consistent reproducible concatenation of
the request elements into a single string

49. Other security measures
Nonces
Timestamps

50. Service setup
OAuth discovery (XRDS)

51. <?xml version=quot;1.0quot; encoding=quot;UTF-8quot;?>
<XRDS xmlns=quot;xri://$xrdsquot;>
<XRD xml:id=quot;oauthquot; xmlns:simple=quot;http://xrds-simple.net/core/1.0quot; xmlns=quot;xri://$XRD*($v*2.0)quot; version=quot;2.0quot;>
<Type>xri://$xrds*simple</Type>
<Expires>2008-12-31T23:59:59Z</Expires>
<Service priority=quot;10quot;>
<Type>http://oauth.net/discovery/1.0/consumer-identity/static</Type>
<LocalID>0685bd9184jfhq22</LocalID>
</Service>
<Service priority=quot;10quot;>
<Type>http://oauth.net/core/1.0/endpoint/resource</Type>
<Type>http://oauth.net/core/1.0/parameters/auth-header</Type>
<Type>http://oauth.net/core/1.0/parameters/uri-query</Type>
<Type>http://oauth.net/core/1.0/signature/HMAC-SHA1</Type>
</Service>
<Service priority=quot;10quot;>
<Type>http://oauth.net/core/1.0/endpoint/authorize</Type>
<Type>http://oauth.net/core/1.0/parameters/uri-query</Type>
<URI>https://api.example.com/session/login</URI>
</Service>
<Service priority=quot;10quot;>
<Type>http://oauth.net/core/1.0/endpoint/access</Type>
<Type>http://oauth.net/core/1.0/parameters/auth-header</Type>
<Type>http://oauth.net/core/1.0/parameters/uri-query</Type>
<Type>http://oauth.net/core/1.0/signature/PLAINTEXT</Type>
<URI>https://api.example.com/session/activate</URI>
</Service>
<Service priority=quot;10quot;>
<Type>http://oauth.net/core/1.0/endpoint/request</Type>
<Type>http://oauth.net/core/1.0/parameters/auth-header</Type>
<Type>http://oauth.net/core/1.0/parameters/uri-query</Type>
<Type>http://oauth.net/core/1.0/signature/PLAINTEXT</Type>
<URI>https://api.example.com/session/request</URI>
</Service>
</XRD>
<XRD xmlns=quot;xri://$XRD*($v*2.0)quot; version=quot;2.0quot;>
<Type>xri://$xrds*simple</Type>
<Service priority=quot;10quot;>
<Type>http://oauth.net/discovery/1.0</Type>
<URI>#oauth</URI>
</Service>
</XRD>
</XRDS>

52. Benefits
Granular authorization
Easy grant and revoke
Tracking of use

53. Many open/free libraries
use them, contribute to them

54. Challenges

55. UI/UX for the Service Provider
Provide basic informations to the user
Ease the user’s choice
Link / enable getting deeper info

56. UI/UX for the Consumer
Explain what’s happening
Educate the user
Use the right language

57. Security considerations
Confidentiality of Requests
Spoofing, Proxying, Phishing
Secrecy of credentials
Cryptographic issues
Denial of Service / Resource Exhaustion

58. Beyond the browser
Mobile devices
Installable applications

60. The sequel
OAuth over XMPP

61. <iq from='travelbot@findmenow.tld/bot'
id='sub1'
to='feeds.worldgps.tld'
type='set'>
<pubsub xmlns='http://jabber.org/protocol/pubsub'>
<subscribe node='bard_geoloc'/>
<oauth xmlns='urn:xmpp:tmp:oauth'>
<oauth_consumer_key>0685bd9184jfhq22</oauth_consumer_key>
<oauth_nonce>4572616e48616d6d65724c61686176</oauth_nonce>
<oauth_signature>wOJIO9A2W5mFwDgiDvZbTSMK%2FPY%3D</oauth_signature>
<oauth_signature_method>HMAC-SHA1</oauth_signature_method>
<oauth_timestamp>1218137833</oauth_timestamp>
<oauth_token>ad180jjd733klru7</oauth_token>
<oauth_version>1.0</oauth_version>
</oauth>
</pubsub>
</iq>

62. The morale
Integrating services can be done
without asking or storing the user’s
credentials while at the same time
gaining flexibility and control.

63. Links!
http://oauth.net
http://oauth.net/core/1.0/
http://code.google.com/p/oauth/
http://groups.google.com/group/oauth/
http://oauth.net/discovery/1.0

64. Thanks for listening!!
Luca Mearelli
http://spazidigitali.com
l.mearelli@spazidigitali.com