An official DNOA release with OAuth 2 support

[Andrew Arnott]

I've received many questions by various channels lately asking when DNOA will issue an official release with OAuth 2.0 support.  So to hit a broad audience, I thought I'd answer that question here:

Not before OAuth 2 itself is finalized as a spec.  

As a builder cannot complete a house before the blueprints are printed and signed, a spec cannot be fully implemented until the spec itself is finished. 

DNOA will periodically issue CTP updates that demonstrate OAuth 2 implementations, but interoperability issues will be pretty much a guarantee as long as other servers implement different drafts of the spec.  Also, we only have enough developer capacity to perform the security review and otherwise ensure we have accounted for error cases after the spec is very stable.  So as stated before, it is not advisable to use CTPs in production environments.

The OAuth 2 spec has been "nearly ready" for at least 1.5 years yet has had multiple significantly breaking changes during that time, so I personally cannot estimate when the spec will be finalized.

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre