Subject: Re: [OAUTH-WG] Dailymotion API using OAuth 2.0 draft 10

From: David Recordon <[email-masked]>
Date: Mon, 1 Nov 2010 00:14:20 -0700

Added you to http://wiki.oauth.net/w/page/OAuth-2. Any parts of the
implementation what were challenging?

On Tue, Oct 26, 2010 at 5:27 PM, Olivier POITREY <[email-masked]> wrote:

> Hi,
>
> I'm proud to announce that Dailymotion released the first beta of its new
> API fully based on OAuth 2.0 draft 10. We are sticking 100% to the spec (we
> hope) and are supporting all client profiles. It's currently in beta, some
> parts are not polished yet (i.e.: authorization page is not skinned) and
> only a few methods are available but the basics are there and fully
> functional.
>
> The documentation of our API can be found here:
>
>  http://www.dailymotion.com/doc/api
>
> Here is the part specific to OAuth 2.0:
>
>  http://www.dailymotion.com/doc/api/authentication.html
>
> We have client SDKs for PHP and Objective-C already available on GitHub (
> http://github.com/dailymotion). We will add Javascript, Python,
> Actionscript and Android SDKs soon.
>
> We are very interested by feedbacks about our implementation before it goes
> final.
>
> <teasing>BTW, our API implements some interesting cache mechanism, but this
> is OT :)</teasing>
>
> Best,
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Olivier POITREY <[email-masked]>
Date: Tue, 2 Nov 2010 14:55:44 +0100

Hi David,

Thank you for adding us. The implementation was straightforward, and the current draft of the spec is clear and easy to read. The only place where we had to adapt a bit was the "insufficient scope" error reporting: our API supports multiple method calls per request, and returning a global error if only one had insufficient scope wasn't very helpful for the developers. We solved this by simply handling insufficient scope errors at the API level.

Best,

On 1 nov. 2010, at 08:14, David Recordon wrote:

> Added you to http://wiki.oauth.net/w/page/OAuth-2. Any parts of the implementation what were challenging?
> 
> 
> I'm proud to announce that Dailymotion released the first beta of its new API fully based on OAuth 2.0 draft 10. We are sticking 100% to the spec (we hope) and are supporting all client profiles. It's currently in beta, some parts are not polished yet (i.e.: authorization page is not skinned) and only a few methods are available but the basics are there and fully functional.
> 
> We have client SDKs for PHP and Objective-C already available on GitHub (http://github.com/dailymotion). We will add Javascript, Python, Actionscript and Android SDKs soon.
> 
> We are very interested by feedbacks about our implementation before it goes final.
> 
> <teasing>BTW, our API implements some interesting cache mechanism, but this is OT :)</teasing>
> 
> Best,
>

---

From: Luke Shepard <[email-masked]>
Date: Wed, 3 Nov 2010 18:16:27 +0000

Awesome!

We have also had similar challenges around insufficient scope. For some APIs, they map very easily to a single scope, but other calls may fail due to the lack of several scopes. Similarly we also handle this error at the API level.

---

From: Andrea Reginato <[email-masked]>
Date: Thu, 4 Nov 2010 01:31:57 +0100

On Tue, Nov 2, 2010 at 2:55 PM, Olivier POITREY <[email-masked]> wrote:

> Hi David,
>
> Thank you for adding us. The implementation was straightforward, and the
> current draft of the spec is clear and easy to read. The only place where we
> had to adapt a bit was the "insufficient scope" error reporting: our API
> supports multiple method calls per request, and returning a global error if
> only one had insufficient scope wasn't very helpful for the developers. We
> solved this by simply handling insufficient scope errors at the API level.
>

Hi Olivier, I was reading the doc and I wanted to make my greetings.

In these days I'm reading several dev doc related to OAuth2 (spec and
provider services) and I've one question I'm not able to find a solution at.
In the User Agent flow, I get pretty well the flow cicle, but I can't
understand if it can be really used, or if it is dangerous for security
problems.

As far as you are one of the few giving this flow service, I wanted to ask
your opinion about. If you have also some documentation, I would love to get
more in touch with the low level details.

-- 
Andrea Reginato

---

From: Darren Bounds <[email-masked]>
Date: Wed, 3 Nov 2010 21:26:09 -0400

David, I didn't realize you were tracking this. If you don't mind, add
Cliqset. We implemented draft 10 (User-Agent and Native App profiles)
a while back.

http://developer.cliqset.com/api#TOC-OAuth-2.0-Overview

Darren

On Mon, Nov 1, 2010 at 3:14 AM, David Recordon <[email-masked]> wrote:
>> We have client SDKs for PHP and Objective-C already available on GitHub
>> (http://github.com/dailymotion). We will add Javascript, Python,

-- 
darren bounds
[email-masked]