[cap-talk] Why tokens have short lifetimes in OAuth-WRAP  David
Barbour dmbarbour at gmail.com Thu Mar 18 01:42:19 PDT 2010
Assume three distributed agents:  * Alice, the Administrator,
provides access-tokens to resources on Sally and other servers
to authorized users. * Sally, the Server, has a bunch of
resources to share. * Carl, the Client, is authorized access to
a resource.  The basic access pattern: Carl proves authority to
Alice and obtains an token T from Alice to access resource R
from Sally. Carl then presents T to Sally to ask for the
resource R. At this point, Sally must determine whether T is a
legal token for R. If it is, then Sally provides Carl the
designated access to the resource.  The goals: avoid proxy and
support revocation. Alice doesn't have a big enough data-pipe to
handle Carl and all his friends.  The question: How does Sally
prove T is a valid token for R?  Answer A: T is volatile and has
a built-in expiration - i.e. perhaps 30 minutes - along with an
authentication code that Sally