#social 2016-06-27

2016-06-27 UTC
shepazu and jasnell joined the channel
#
cwebber2 aaronpk: around?
#
cwebber2 I'd like to ask you some questions about indieauth
#
aaronpk sure
#
cwebber2 aaronpk: so indieauth is... a standard or an implementation?
#
cwebber2 I thought, at one point, we talked about it like it was a standard
#
cwebber2 but now it looks to me like it's an implementation combining oauth 2.0, web sign-in, and rel-me auth?
#
cwebber2 is that right?
#
aaronpk heh
#
ben_thatmust its sort of both
#
aaronpk no
#
ben_thatmust right?
#
aaronpk indieauth.com is a service
#
aaronpk IndieAuth is a protocol
#
aaronpk i never should have named it indieauth.com but here we are
#
cwebber2 aaronpk: heh, ok :)
#
aaronpk indieauth.com is also two different services
#
ben_thatmustbeme just to confuse things more
#
aaronpk one for app developers, one for users
#
cwebber2 aaronpk: I'm trying to find the indieauth spec, and not really finding it. https://indiewebcamp.com/indieauth-for-login that's not it, is it?
#
aaronpk there isn't actually a complete spec document really, there are just many tutorials/walkthroughs of the various flows
#
aaronpk everything is ultimately linked from here http://indiewebcamp.com/Category:IndieAuth
#
cwebber2 aaronpk: ah, I see..
#
aaronpk depending on whether you're using IndieAuth for identity or authorization, you'll read https://indiewebcamp.com/indieauth-for-login or http://indiewebcamp.com/obtaining-an-access-token
#
aaronpk you probably want the latter
#
cwebber2 aaronpk: another question, does this mean that since micropub has indieauth as a SHOULD that it needs it to go through the same process that microformats / etc had as in terms of a "stable" living spec?
#
cwebber2 we talked about maybe using the same workflow, and I'm trying to iron out this part of APub/ASub, so I'm looking into what that means
#
cwebber2 or is it not required because it's SHOULD rather than MUST?
#
aaronpk i can't remember actually... ping sandro?
#
cwebber2 it certainly seems like it would be a good idea for it to have a more stable specification if it's going to fill such a large gap of our specs
#
aaronpk agreed
#
aaronpk it's been on my todo list forever
#
cwebber2 aaronpk: thanks for the help
#
cwebber2 I'm reading the docs
#
cwebber2 aaronpk: these docs seem a bit optimized around assuming that the client is a web application also, right?
#
cwebber2 might be worth adding a section for "mobile" applications, etc, where there isn't a redirect uri
#
aaronpk at that point it's just oauth2
#
aaronpk there can still be a redirect URI with mobile applications
#
cwebber2 hm, there can?
#
cwebber2 aaronpk: do you have an example?
#
aaronpk on ios it's done with a custom scheme (myapp://auth), on android the app can register to be launched by any URL pattern
#
cwebber2 ah
#
aaronpk https://github.com/aaronpk/ArcGIS-OAuth2-Demo-iOS
#
cwebber2 aaronpk: thanks!
#
aaronpk there's a new iOS api that lets you open an embedded browser that still shows the address bar and the app doesn't have access to the data, so you can do OAuth without having the user switch apps. i don't have an example of that yet tho.
#
aaronpk but ultimately for those kinds of questions, the answers that OAuth2 provide should apply here as well
#
cwebber2 aaronpk: yeah unfortunately we also have a lot of gnu/linux distro desktop users, so the fragmented means of handling this on mobile stuff and lack of real standards for this doesn't solve it, so! guess I'll have to see how oauth2.0 handles it
#
cwebber2 aaronpk: I'm still pretty green to diving into the world of oauth 2 (and I only briefly dipped my toe in oauth 1, tsyesika did most of that work) so I'm finding myself overwhelmed
#
aaronpk there's also a "device flow" for OAuth 2 which is meant for logging in to devices that don't have a full browser, like TVs or other hardware
#
cwebber2 aaronpk: aha, ok, thanks
#
aaronpk you've probably seen that if you've logged in to a cable service provider on an apple tv
#
aaronpk i would actually look at how other desktop apps do it though
#
aaronpk if that's your use case
#
cwebber2 aaronpk: yeah, well it's one use case!
#
cwebber2 aaronpk: thanks
#
aaronpk i've seen some desktop apps do what appears to be the normal oauth flow, but instead of automatically redirecting after the user signs in in a browser, they just say "close the browser and return to the app" and the app has a "continue" button, pressing "continue" is essentially the redirect
#
aaronpk so basically the normal web app flow, but a manual click instead of automatic redirect.
#
cwebber2 aaronpk: the not super pleasant way that the destop pump.io applications did things was to have the user copy and paste back in the token
#
cwebber2 which is clearly not nice.
#
aaronpk yeah i've seen that too. definitely not a good flow.
#
aaronpk er sorry, s/normal web app flow/device auth flow/
#
aaronpk actually i guess that's different. nevermind.
shepazu joined the channel