Difference between revisions of "OAuth Client"
From MgmtWiki
(→Solution) |
(→Solution) |
||
| Line 11: | Line 11: | ||
==Solution== | ==Solution== | ||
| − | * [ https://mail.google.com/mail/u/0/#inbox/FMfcgzGxStwKpnqltBMQKSRBbLFshJnF?projector=1&messagePartId=0.1 OAuth WG Virtual Interim - Attestation-Based Client Authentication] is just the latest attempt to overcome the misuse of OAuth to preform Authentication on behalf of a user's adversary, which is called the user's client. (2024-05-23) | + | * [https://mail.google.com/mail/u/0/#inbox/FMfcgzGxStwKpnqltBMQKSRBbLFshJnF?projector=1&messagePartId=0.1 OAuth WG Virtual Interim - Attestation-Based Client Authentication] is just the latest attempt to overcome the misuse of OAuth to preform Authentication on behalf of a user's adversary, which is called the user's client. (2024-05-23) |
==References== | ==References== | ||
Latest revision as of 13:58, 23 May 2024
Full Title or Meme
An OAuth Client is a piece of software that is acting on behalf of an Entity that wants to acquire Authorization to access a Subject's resources or attributes.
- The role of any provider that requires getting authentication from a separate Identifier or Attribute Provider Role.
- The role of a user that seeks to use resources on an internet based server.
Context
- The term Client has multiple meanings though-out computer science. Typically it is used in the context of client-server computing.
- OAuth 2.0 really messed with people's minds by calling a Relying Party a client of a user when the user grants it access to user-controlled resources.
- See the wiki page OAuth Client for a discussion about when and whether a computer user should trust such an entity.
Solution
- OAuth WG Virtual Interim - Attestation-Based Client Authentication is just the latest attempt to overcome the misuse of OAuth to preform Authentication on behalf of a user's adversary, which is called the user's client. (2024-05-23)
