Roles and protocol endpoints
Jan Algermissen
Eran Hammer
The roles are simple:
Application is the client, the role making API calls.
User is the resource owner, the role granting access.
Server or Service provider is the API host.
Right now I have sketched three endpoints but this list is clearly incomplete and will evolve/change in the next few weeks:
/app – use Basic auth over TLS to exchange app credentials for app ticket. Mobile apps will not have a password, but looking for other ways to improve their authentication (though not guarantee it as that is not possible).
/rsvp – there is still no endpoint to obtain an rsvp (a token representing user approval), but this endpoint will take an rsvp and return a ticket scoped for the same access approved.
/reissue – send a ticket, get back a new ticket with same scope. Optional parameter to reissue for another app (if allowed).
EH
--