attachment
<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Smith,<div class=""><br class=""></div><div class="">OK, so to "help" I think we need to separate things because OAuth2 has three distinct steps:</div><div class=""><br class=""></div><div class="">1. Web-based authentication/authorization - a web browser has to be used, out-of-band from IPP, to obtain a "grant" from the Authorization Server. The grant is supplied via a URL redirect that is primarily geared towards web services (point to a HTTPS web page on service X) but can also use application-specific URL schemes ("<a href="myspecialapp://bla/?code=fsdlfkjasdfdsfsd0324df" class="">myspecialapp://bla/?code=fsdlfkjasdfdsfsd0324df</a>"), which is how you implement OAuth2 for so-called "native apps".</div><div class=""><br class=""></div><div class="">2. Once you have the grant, you can request an "access token" (and optionally a "refresh token", which is essentially a grant you can use at a later time to keep using the resource) from the authorization server using a HTTP POST (no web browser needed).</div><div class=""><br class=""></div><div class="">3. Once you have the access token, you can supply it in response to the HTTP 401 status code with a "WWW-Authenticate: Bearer" header.</div><div class=""><br class=""></div><div class="">Only step 1 requires a web browser.</div><div class=""><br class=""></div><div class=""><div class="">Only step 3 is in-band of IPP.</div></div><div class=""><br class=""></div><div class="">The token you get in steps 1 and 2 can potentially be reused indefinitely. When you get a 401 with and error parameter in the WWW-Authenticate header, it is time to either a) refresh the access token or b) repeat steps 1 and 2 to re-authenticate.</div><div class=""><br class=""></div><div class="">The list of RFCs is extensive (<a href="https://oauth.net/2/" class="">https://oauth.net/2/</a>) but the important ones for IPP are:</div><div class=""><br class=""></div><div class="">- RFC 6749: The OAuth 2.0 Authorization Framework (doing out-of-band authentication and getting access tokens)</div><div class="">- RFC 6750: OAuth 2.0 Bearer Token Usage (doing in-band authentication)</div><div class="">- RFC 7636: Proof Key for Code Exchange (doing out-of-band authentication more securely with native Client applications)</div><div class="">- RFC 8252: Recommendations for using OAuth 2.0 with native apps (doing out-of-band authentication on a Client - for implementors)</div><div class=""><br class=""></div><div class="">The following Internet Draft will (hopefully) define how an input constrained device like a printer can authenticate as a client (important for IPP INFRA proxies).</div><div class=""><br class=""></div><div class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Oct 25, 2017, at 3:59 PM, Kennedy, Smith (Wireless Architect) <<a href="mailto:smith.kennedy@hp.com" class="">smith.kennedy@hp.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi Mike,<br class=""><br class="">One of my action items to move the IPP Authentication white paper forward was to solicit help from you in correcting the OAuth2 diagram(s). Could you take a look at the attached PlantUML sequence diagram files and make corrections you feel are needed? The versions from the latest white paper (from August) are attached - there are two of them. You can edit it in any text editor, then render it using the PlantUML tool:<br class=""><br class=""><a href="http://plantuml.com/download" class="">http://plantuml.com/download</a><br class=""><br class="">Thanks in advance! <br class=""><br class="">Smith<br class=""><br class="">/**<br class=""> Smith Kennedy<br class=""> Wireless Architect - Client Software - IPG-PPS<br class=""> Standards - IEEE ISTO PWG / Bluetooth SIG / Wi-Fi Alliance / NFC Forum / USB IF<br class=""> Chair, IEEE ISTO Printer Working Group<br class=""> HP Inc.<br class="">*/<br class=""><br class=""><br class=""><span id="cid:CEA9065E8580FB4F99B8E08A9E99099B@NAMPRD84.PROD.OUTLOOK.COM"><ipp-authentication-6-http-oauth2.pu></span><span id="cid:6740B43CAB28CC498F1AF71A309D16FB@NAMPRD84.PROD.OUTLOOK.COM"><ipp-authentication-8-http-oauth2-with-digest.pu></span></div></div></blockquote></div><br class=""><div class="">
<span class="Apple-style-span" style="border-collapse: separate; font-family: "Andale Mono"; font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; line-height: normal; border-spacing: 0px;"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: 'Andale Mono'; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-stroke-width: 0px;"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">_________________________________________________________<br class="">Michael Sweet, Senior Printing System Engineer</div></span></div></span>
</div>
<br class=""></div></body></html>