Mailing-List: contact user-help@oltu.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@oltu.apache.org
MIME-Version: 1.0
In-Reply-To: 
 <A562FE5D3662044186474F4174F11DAE12E4AEC71C@iowajhnex126.iowa.gov.state.ia.us>
References: 
 <A562FE5D3662044186474F4174F11DAE12E4AEC71C@iowajhnex126.iowa.gov.state.ia.us>
From: Jasha Joachimsthal <jasha@apache.org>
Date: Thu, 22 Jan 2015 18:34:56 +0100
Message-ID: 
 <CAE=UxW81g0T_OEmSYXxtXMdR84nWu9F8CxBAOEG5Bi=URzNN_Q@mail.gmail.com>
Subject: Re: Verifying the authorization server
To: user@oltu.apache.org
Cc: "dev@oltu.apache.org" <dev@oltu.apache.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

That's what the state parameter is for. You generate this value and
keep it in a session. When the user returns to the redirectUri, the
OAuth provider must have returned the state parameter's value. Compare
this with the value in the session. If they don't match, your code
should not continue with the authorization.

See also [1]

Regards,

Jasha

[1] http://www.thread-safe.com/2014/05/the-correct-use-of-state-parameter-i=
n.html


On 22 January 2015 at 17:13, Tiburtius, Ashwanth [IWD]
<Ashwanth.Tiburtius@iwd.iowa.gov> wrote:
> Hi,
>
>
>
> I am using Apache Oltu in our project to authenticate Google, Yahoo and
> Microsoft users. I have a fundamental question =E2=80=93 when a user has
> authenticated themselves and the authorization server redirects them back=
 to
> the application using the redirect uri along with a code, from a security
> perspective, how can we verify that the code came from the respective
> service - for e.g: Google? Does the authorization server send back
> certificate or signatures that can be used to verify itself? If so, does
> Oltu take care of this or is it upto the application to do the verificati=
on?
> Can you provide any help as to how the application should verify the serv=
er
> in case Oltu doesn=E2=80=99t do it currently?
>
>
>
> Just fyi, in our application, we are only concerned about a successful
> authentication which is the first step in OAuth process. We do not access
> any information about the user, so we are not getting into the next steps=
 to
> get access token etc. at this point. I am not sure if that is an issue.
>
>
>
> I would really appreciate your comments/replies. Thank you for your time.
>
>
>
> Thanks,
>
> Jude.
>
> Iowa Workforce Development =E2=80=93 IT | 1000 E Grand Ave, Des Moines, I=
A  50319
>
> (515) 281-3378 | Ashwanth.Tiburtius@iwd.iowa.gov
>
>