Re: [Mailman-Developers] Architecture for extra profile info

My understanding of the use of oAuth to provide "login" information from Google, Twitter, etc. is based on the following description provided by Google.
Below is a trivial example of how to use Google's OAuth 2.0 endpoint to gain access to a Google API. It's a Python web application running on App Engine. The flow of the example is fairly straightforward: When the application loads, it shows the you a "Login" link. When you click that link, you are asked to login to Google and asked to release basic account information to the application (user consent). If you grant consent, the application receives an access token. Once it has the access token, the application presents the access token to the Google API that provides basic account information (https://www.googleapis.com/oauth2/v1/userinfo) The application renders the basic account information in a simple table. In particular, a user grants our server the permission to access some information pertaining to the user as it is stored by Google and accessed through their API for the purpose.
Based on that information, our server grants permission to the user thus identified and based on authorization data stored in our system. Once we have identified the user, our system can use tokens such as session keys, or other mechanisms, to maintain the association.
Richard
On Apr 28, 2013, at 2:42 PM, Xu Wang <xuwang@gmail.com> wrote:

Well, it is about how a third party web application can get user's profile data from google as oauth client, like OpenID, it's little help on the access control of a third party RESTful API.
As oauth supported google's userinfo API, one need to present a valid google's oauth access token to get access. s/google/mailman/g on above statement, it will be true too.
If we are talking about enable OpenID or get user's profiles from google, facebook, tweeter, etc. as an OAuth client in postorius, it should not be a big deal because the client libs are readily available from those providers, but it is different from claiming mailman's api supports OAuth.
On Sun, Apr 28, 2013 at 6:47 PM, Richard Wackerbarth <rkw@dataplex.net>wrote:

Well, it is about how a third party web application can get user's profile data from google as oauth client, like OpenID, it's little help on the access control of a third party RESTful API.
As oauth supported google's userinfo API, one need to present a valid google's oauth access token to get access. s/google/mailman/g on above statement, it will be true too.
If we are talking about enable OpenID or get user's profiles from google, facebook, tweeter, etc. as an OAuth client in postorius, it should not be a big deal because the client libs are readily available from those providers, but it is different from claiming mailman's api supports OAuth.
On Sun, Apr 28, 2013 at 6:47 PM, Richard Wackerbarth <rkw@dataplex.net>wrote:
participants (2)
-
Richard Wackerbarth
-
Xu Wang