tags:

views:

14

answers:

0
Q: 

OAUTH 2.0 -like implementation, but using asymmetric keys?

Hi all,

I have a working implementation of an OAUTH 2.0 Authentication solution using the standard HMAC shared key mechanism. A new requirement has been added: The servers issuing the tokens are secure, but some of the servers which will "trust" issued tokens are considered "semi secure", and should not have access to the shared secret which is used to issue the token.

What I've come up with so far is to tweak the algorithm to use asymmetric keys- the issuer would sign with a private key and the trusting servers would validate using the public key.

Has this been done before? Does it sound feasible?

related questions

XSRF protection in an AJAX style app
Can OAuth be used to schedule Twitter status updates in the future?
2 legged oauth - looking for information
How to get Uri.EscapeDataString to comply with RFC 3986
OAuth - lexicographical byte value ordering in c#
OpenID authentication from an installed application
What is excatly the technology stack defining Web APIs?
Problem with Google Hybrid Protocol (OpenID + OAuth) Demo
How to integrate google's Step2 with acegi security in the Grails Framework?
OAuth alternative?
OAuth? ,OpenID? Neither? Which one should my site support?
Twitter oAuth callbackUrl - localhost development
Example of a good Webservice
Sorting by key and value in case keys are equal
What does the oauth guide mean by "8 bit array"?
Using OAuth for server-to-server authentication?
Getting 401 on Twitter OAuth POST requests
How do I develop against OAuth locally?
Can OAuth work with mobile phone applications?
Security of REST authentication schemes
How do you manage api keys
How can I verify a Google authentication API access token?
How do you debug an ASP.Net application accessing an OAuth secured API?
oAuth REST and C# What's the missing piece
PHP Tutorial for OpenId and OAuth