Mailing-List: contact users-help@cxf.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@cxf.apache.org
Received-SPF: pass (nike.apache.org: domain of craigmcc@gmail.com designates
 209.85.215.54 as permitted sender)
MIME-Version: 1.0
Reply-To: craigmcc@gmail.com
In-Reply-To: <50FE7690.7060201@gmail.com>
References: 
 <CANgkmLA_3afcRGeqZ8oYEUfQE25+kJSoTpsGS64cKTTPzmj=vw@mail.gmail.com>
	<50FE7690.7060201@gmail.com>
Date: Tue, 22 Jan 2013 08:54:54 -0800
Message-ID: 
 <CANgkmLCgeJ1CpFcWU0fvU8eDm_63ZuxoRv=UngbbUEztx6MRow@mail.gmail.com>
Subject: Re: Implementing the OAuth 2.0 Authorization Code Grant Flow
From: Craig McClanahan <craigmcc@gmail.com>
To: users@cxf.apache.org
Content-Type: multipart/alternative; boundary=e0cb4efa6dfce3ea2d04d3e36fc5

--e0cb4efa6dfce3ea2d04d3e36fc5
Content-Type: text/plain; charset=ISO-8859-1

On Tue, Jan 22, 2013 at 3:22 AM, Sergey Beryozkin <sberyozkin@gmail.com>wrote:

> Hi Craig
>
> Actually, I may've just got it :-), you'd like to have a user, after an
> initial redirect, facing a form asking both for the authentication info and
> the authorization approval ?
>
> Yep, exactly.


> Hmm... I think 1) and 2) above is OK, the only downside is the not too
> ideal user experience, where one dialog (authentication) is followed up by
> another one (authorization). This is mitigated if SSO is in place.
>
> But I wonder if presenting the authorization request to the user which has
> not yet authenticated is actually safe. One limitation is also that the
> authorization request page can not be personalized, for ex, if the user has
> authenticated then the page may say "Welcome Barry, the following
> third-party app would like to ...".
>
> By the way, looks like according to
>
> http://help.salesforce.com/**help/doc/en/remoteaccess_**
> oauth_web_server_flow.htm<http://help.salesforce.com/help/doc/en/remoteaccess_oauth_web_server_flow.htm>
> and
> http://help.salesforce.com/**help/doc/en/remoteaccess_**
> oauth_web_server_flow.htm<http://help.salesforce.com/help/doc/en/remoteaccess_oauth_web_server_flow.htm>
>
> What's not obvious from these diagrams is that the SalesForce "authorize"
endpoint (https://login.salesforce.com/services/oauth2/authorize) does not
require the user to be logged on yet, so you can do both operations on a
single request.  I've suppose we'd want to recognize the user if they have
been logged in, but allow them to log in and authorize if not.

Craig

--e0cb4efa6dfce3ea2d04d3e36fc5--