Implement OAuth 2.0

[davetosh]

[garemoko]

Hi,

Sorry I didn't flag this up sooner - I only just made the connection myself.

We should prioritise implementing OAuth 1 as that's the version set out in the spec. OAuth 2.0 support is still very nice to have though.

Andrew

[davetosh]

OAuth is an interesting one. While looking over the spec and supporting blog posts, there appears to be a mixture of OAuth 1.0 and 2.0 mentioned. Given this, we decided to go with OAuth 2.0 as that is what the majority of the major services (Twitter aside) have adopted.

In this post - http://tincanapi.com/building-a-learning-record-store/ - OAuth 2.0 is mentioned "An LRS has to follow oAuth 2.0's scope parameter" and throughout the spec there is reference to both such as:

https://github.com/adlnet/xAPI-Spec/blob/master/xAPI.md#oauthscope - "The LRS MUST accept a scope parameter as defined in OAuth 2.0"

https://github.com/adlnet/xAPI-Spec/blob/master/xAPI.md#security - "The LRS MUST support authentication using at least one of the following methods: OAuth 1.0 (RFC 5849)...."

While read this, it didn't sound like OAuth 2.0 is being treated as a further options as well as OAuth 1.0, it sounds like the two are being talked about as if the same thing - which they are not. That said, I could have the wrong end of the stick.

OAuth 1.0 and 2.0 are essentially different beasts so I think we will only have time to adopt one or the other at this time and given a fair bit of leg work has been done for OAuth 2.0, I would vote for that.

[garemoko]

That part confused me too. I know understand that the idea is that oauth 1 is what's suggested but that the scopes are being borrowed from oauth 2.

That said, there's nothing in the spec to say that we have to support oauth 1 and that we can't support oauth 2. It's just that client applications are more likely to look to support oauth 1. I'm not aware if any that actually exist at the moment though.

How much work have we put into oauth 2 and how much is remaining?

[davetosh]

A good bit of the ground work is in rc1 - we forked https://github.com/LearningLocker/oauth2-server-laravel to work with LL and if you look in routes.php you will see routes that let apps authorize. Really, the last remaining thing is to devise a couple of default grant types, wire those up and it will be ready to test.