Separating authentication and authorization [federated identities]

[François Kooman]

Hi,

I'm very interested in seeing something simpler, stricter and more
secure than OAuth 2.0!

For our "enterprise", but not just enterprise, use case the way OAuth
2.0 works with the "webview" and registered custom scheme for native
apps allows us the option of separating authentication and
authorization at the OAuth AS. This is important as we can then plug any
authentication backend, like Mozilla Persona/BrowserID,
OpenID, or, yes, even SAML which happens to be important for the
research and education field with lots of SAML deployed. We don't use
SAML at all as part of the OAuth protocol, just for the authentication
of users...

It seems the plan so far is to just support the username/password.
What are your thoughts on integration with services that use OpenID,
BrowserID, or SAML to authenticate its users where no password is
available at the service to verify against. Do you have any (other)
thoughts on solving this "federated identity" scenario with OZ?

Thanks!

Regards,
Fran�ois