March 3, 2010
.Nat Zone : OpenID v.s. OAuth by Nat - .Nat Zone

(表1) OpenID と OAuth の比較

項目 OpenID OAuth
IdPの名称 OP (OpenID Provider) SP (Service Provider)
RPの名称 RP Consumer
RPの識別 realmから自動で識別 Consumer Keyを事前に手動で取得
署名鍵の交換 Associationで動的に交換 手動で事前に交換
ユーザー識別子 ユーザーが選択したOpenID対応識別子 SPがユーザーに与えた識別子
Artifactの名称 Artifact Request Token
Assertionの名称 Assertion Access Token
根底にある哲学 ユーザー中心主義 サービス提供者(アプリケーション)中心主義

Posted via web from 原宿工業大学 | Comment »

February 16, 2010
s-take Blog.: Twitterによる簡易版OAuth: “xAuth”

OAuthにくらべてアプリケーション側もユーザ側も作業を簡略化できるxAuthですが、当然デメリットがあります。OAuthの利点の一つ、ユーザがアプリケーションにパスワードを預けなくても良いという点が完全に失われます。xAuthでは一度Access Tokenを取得してしまえばそれ以降パスワードは使用しませんが、アプリケーションがパスワードをちゃんと破棄したかどうかはユーザにはわかりません。もしかしたらこっそりパスワードを保存していて、裏でこそこそと悪さをしてしまうかもしれないのです。つまり、Basic認証によるAPI利用の欠点(のひとつ)をxAuth認証も抱えているわけです。(まあ、認証したらすぐにパスワードを変えちゃうってのもアリですが、Twitterのパスワード変更は色々と面倒なので…)

Posted via web from hdknr’s posterous | Comment »

Why YAuth is not OAuth - Stake Ventures

The only problem is that Yahoo quietly pushed through an extension to OAuth called the OAuth Session Extension. This was all done publicly but it involves some major changes to OAuth token management, which is the exact thing that has been hardest for people to understand about OAuth in the first place.

Posted via web from hdknr’s posterous | Comment »

February 9, 2010
python-oauth2 : インストールと確認

とりあえずGithubでフォークした。

pipでインストール

(twitq)hdknr@deblen:~/.ve/twitq/src$ pip install -e git+ssh://git@github.com/hdknr/python-oauth2.git#egg=python-oauth2
Obtaining python-oauth2 from git+ssh://git@github.com/hdknr/python-oauth2.git#egg=python-oauth2
  Cloning ssh://git@github.com/hdknr/python-oauth2.git to ./python-oauth2
remote: Counting objects: 427, done.
remote: Compressing objects: 100% (157/157), done.
remote: Total 427 (delta 199), reused 427 (delta 199)
  Running setup.py egg_info for package python-oauth2
Installing collected packages: python-oauth2
  Running setup.py develop for python-oauth2
    Creating /home/hdknr/.ve/twitq/lib/python2.5/site-packages/oauth2.egg-link (link to .)
    Adding oauth2 1.0.5 to easy-install.pth file

       Installed /home/hdknr/.ve/twitq/src/python-oauth2
Successfully installed python-oauth2

確認

(twitq)hdknr@deblen:~/.ve/twitq/src$ tree python-oauth2/
python-oauth2/
|-- LICENSE.txt
|-- README.md
|-- debian
|   |-- changelog
|   |-- compat
|   |-- control
|   |-- copyright
|   |-- pycompat
|   |-- pyversions
|   `-- rules
|-- example
|   |-- client.py
|   `-- server.py
|-- oauth2
|   `-- __init__.py
|-- oauth2.egg-info
|   |-- PKG-INFO
|   |-- SOURCES.txt
|   |-- dependency_links.txt
|   |-- top_level.txt
|   `-- zip-safe
|-- setup.cfg
|-- setup.py
`-- tests
    `-- test_oauth.py
 5 directories, 20 files

httplib2が必要だった。

(twitq)hdknr@deblen:~/.ve/twitq/src$ python
Python 2.5.2 (r252:60911, Jan 24 2010, 14:53:14)
[GCC 4.3.2] on linux2
Type “help”, “copyright”, “credits” or “license” for more information.
»> import oauth2 as oauth
Traceback (most recent call last):
  File “<stdin>”, line 1, in <module>
  File “/home/hdknr/.ve/twitq/src/python-oauth2/oauth2/__init__.py”, line 31, in <module>
    import httplib2
ImportError: No module named httplib2

(twitq)hdknr@deblen:~/.ve/twitq/src$ yolk -S name=httplib2
httplib2 (0.6.0):
        A comprehensive HTTP client library. (twitq)hdknr@deblen:~/.ve/twitq/src$ pip install httplib2
Downloading/unpacking httplib2
  Downloading httplib2-0.6.0.tar.gz (53Kb): 53Kb downloaded
  Running setup.py egg_info for package httplib2
Installing collected packages: httplib2
  Running setup.py install for httplib2
Successfully installed httplib2

動作確認

キー、シークレットは潰しています。
(twitq)hdknr@deblen:~/.ve/twitq/src$ python
Python 2.5.2 (r252:60911, Jan 24 2010, 14:53:14)
[GCC 4.3.2] on linux2
Type “help”, “copyright”, “credits” or “license” for more information.
»> import oauth2 as oauth
»> c=oauth.Consumer(‘fdafdsafdsafsdafdsaf’,’fdsafdsafdasfdsafdsafsdafa’)
»> url=“http://twitter.com/oauth/request_token”;
»> client = oauth.Client(c)
»> res,content = client.request(url,’GET’)
»> type(res)
<class ‘httplib2.Response’>
»> type(content)
<type ‘str’>
»> print content
oauth_token=reoqrdsafdsalfdsafd432fhdsahfdhsafdsafdsafdas&oauth_token_secret=fdr42qr3ofdoashfdsafedeq
»> print res
{‘status’: ‘200’, ‘content-length’: ‘116’, ‘content-location’: ‘http://twitter.com/oauth/request_token?oauth_nonce=91616366&oauth_timestamp=1265663914&oauth_consumer_key=fdsafdasfdafdafdsafda&oauth_signature_method=HMAC-SHA1&oauth_version=1.0&oauth_signature=fdsafdafdafdsafdsafdsafdaf%3D’;, ‘x-transaction’: ‘542354954-432143-4324’, ‘set-cookie’: ‘_twitter_sess=fdasfdsafdsa%dsafdsafdf%fdsafa—fdsafdsa; domain=.twitter.com; path=/’, ‘expires’: ‘Tue, 31 Mar 1981 05:00:00 GMT’, ‘vary’: ‘Accept-Encoding’, ‘x-runtime’: ‘0.01270’, ‘server’: ‘hi’, ‘x-revision’: ‘DEV’, ‘last-modified’: ‘Mon, 08 Feb 2010 21:18:34 GMT’, ‘connection’: ‘close’, ‘etag’: ‘“2a33d94df68b07474217bf29f093c169”-gzip’, ‘pragma’: ‘no-cache’, ‘cache-control’: ‘no-cache, no-store, must-revalidate, pre-check=0, post-check=0’, ‘date’: ‘Mon, 08 Feb 2010 21:18:34 GMT’, ‘content-type’: ‘text/html; charset=utf-8’, ‘-content-encoding’: ‘gzip’}

Posted via email from 原宿工業大学 | Comment »

February 8, 2010
.Nat Zone : OAuth Wrap Web App Profile Summary by Nat - =nat

January 30, 2010
Step by Step Guide to use Sign in with Twitter with Django « Agile Web Development

If you will have a look at OAuth examples on twitter apiwiki there are already examples available to use Sign in with Twitter with Django, so why this new howto and example code. Because being a perfectionist I like things to be the standard way, so for authentication django allows you to specify your own customized authentication backends. I thought why should not that be utilized to authenticate the Django User object with twitter.

Posted via web from 原宿工業大学 | Comment »

Twitter / アプリケーション : OAuthのコンシューマーキーの登録

Welcome to the Developer Beta of the Twitter Application Platform! We’re just getting started, but we thought we’d start releasing components that will help you, the developers, connect your users with the world, right now.

For starters, we’re allowing you to both register your application here, as well as providing an improved Authentication System, OAuth. To read more about how this help both you and your users, please visit http://oauth.net.

Enjoy! And please report any bugs or general feedback to api@twitter.com.

Posted via web from 原宿工業大学 | Comment »

September 27, 2009
OpenID: Now more powerful and easier to use! | OpenID

Plaxo is one of the earliest adopters of OpenID, allowing their users to sign into Plaxo using an OpenID enabled account with just a couple mouse clicks. Instead of requiring first-time Plaxo users to manually verify their email address by sending a verification email, Plaxo uses OpenID Attribute Exchange to verify Yahoo! and GMail email addresses without forcing users to wait at their mailbox for the verification email to arrive. Building on their successful experience with OpenID, Plaxo is experimenting with the Hybrid Protocol: A portion of new users who sign up for Plaxo using either a GMail or Yahoo account can now sign into Plaxo with their OpenID and authorize two-way data sharing of their Contacts and Activities via the Hybrid Protocol. You can read more about how this works on the Plaxo blog.

Posted via web from hdknr’s posterous | Comment »