OAuth Challenge Grant?
Session Topic: OAuth2 challenge/response grant
Convener: Samuel E.
Notes-taker: Erik Wahlström
Discussion notes, key understandings, outstanding questions, observations, and, if appropriate to this discussion: action items, next steps:
- How to integrate physical access systems into digital access systems.
- OAuth2 in IoT scenarios where policies and deceptions is taken on the AS.
- Sometimes the AS requires different attributes for a specific client to be able to issue a token.
- Example: A IoT enabled door takes a JWT to open up the door. Sometimes the user waives an NFC/RFID based card in front of a card reader to authenticate, but sometimes the user also have to enter a PIN code to be able to open up the door. The policy for the door is changed centrally in the AS.
- The question is: Can this be defined in a new grant type that uses a challenge/response mechanism or is this outside of the spec and it’s just authentication to in a code grant flow.
- It depends on architecture. Is card the client, or is the reader the client?
- What happens when things are offline? Some work have been done by neXus with a JWT that includes an ACL.
Discussions flows out in to a general security in IoT discussion.