Subject: [Ace] OAuth-based Strawman for ACE

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 04 Jul 2014 14:03:04 +0200

Hi all,

I have been playing around with the idea of using OAuth for the IoT
context for a while now. It turns out that others have had similar ideas
and various blog post and presentations can be found on the Web already.
Unfortunately, most of them are completely insecure. For this this I
have put my thoughts on "paper" on how I would design such a solution.

The approach is described in two documents, namely:

(a) The OAuth 2.0 Internet of Things (IoT) Client Credentials Grant
https://datatracker.ietf.org/doc/draft-tschofenig-ace-oauth-iot/

(b) The OAuth 2.0 Bearer Token Usage over the Constrained Application
Protocol (CoAP)
https://datatracker.ietf.org/doc/draft-tschofenig-ace-oauth-bt/

(a) describes a new OAuth grant type that allows a constrained client to
obtain an access token and (b) describes how to convey that access token
over CoAP from the client to a resource server.

If the client is not constrained (as it would be the case for a smart
phone) then (a) is not needed and regular OAuth could be used. In other
cases the use of CoAP between the client and resource server may not be
appropriate and then (b) is not applicable.

While this is not relevant for ACE at this point in time (since we are
at the stage of use cases and requirements) I thought it still provides
some useful data points.

If you have feedback please drop me a mail.

Ciao
Hannes

---

From: Likepeng <[email-masked]>
Date: Tue, 15 Jul 2014 03:31:03 +0000

> (b) The OAuth 2.0 Bearer Token Usage over the Constrained Application Protocol (CoAP)

About Section 5, Error Option Definition, we can reuse Code (Section 3 in RFC7252) in the CoAP header for that. Just defining some code numbers should be fine.

Kind Regards
Kepeng

> -----邮件原件-----
> 发件人: Ace [mailto:[email-masked]] 代表 Hannes Tschofenig
> 发送时间: 2014年7月4日 20:03
> 收件人: [email-masked]
> 主题: [Ace] OAuth-based Strawman for ACE
> 
> Hi all,
> 
> I have been playing around with the idea of using OAuth for the IoT context for
> a while now. It turns out that others have had similar ideas and various blog
> post and presentations can be found on the Web already.
> Unfortunately, most of them are completely insecure. For this this I have put
> my thoughts on "paper" on how I would design such a solution.
> 
> (a) describes a new OAuth grant type that allows a constrained client to obtain
> an access token and (b) describes how to convey that access token over CoAP
> from the client to a resource server.
> 
> phone) then (a) is not needed and regular OAuth could be used. In other cases
> the use of CoAP between the client and resource server may not be
> While this is not relevant for ACE at this point in time (since we are at the stage
> of use cases and requirements) I thought it still provides some useful data
> points.
>