{"action":"created","issue":{"url":"https://api.github.com/repos/hypothesis/h/issues/2084","labels_url":"https://api.github.com/repos/hypothesis/h/issues/2084/labels{/name}","comments_url":"https://api.github.com/repos/hypothesis/h/issues/2084/comments","events_url":"https://api.github.com/repos/hypothesis/h/issues/2084/events","html_url":"https://github.com/hypothesis/h/issues/2084","id":64046334,"number":2084,"title":"ID Token / Access Token Disambiguation","user":{"login":"tilgovi","id":20818,"avatar_url":"https://avatars.githubusercontent.com/u/20818?v=3","gravatar_id":"","url":"https://api.github.com/users/tilgovi","html_url":"https://github.com/tilgovi","followers_url":"https://api.github.com/users/tilgovi/followers","following_url":"https://api.github.com/users/tilgovi/following{/other_user}","gists_url":"https://api.github.com/users/tilgovi/gists{/gist_id}","starred_url":"https://api.github.com/users/tilgovi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tilgovi/subscriptions","organizations_url":"https://api.github.com/users/tilgovi/orgs","repos_url":"https://api.github.com/users/tilgovi/repos","events_url":"https://api.github.com/users/tilgovi/events{/privacy}","received_events_url":"https://api.github.com/users/tilgovi/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hypothesis/h/labels/0%20-%20Uncategorized","name":"0 - Uncategorized","color":"CCCCCC"},{"url":"https://api.github.com/repos/hypothesis/h/labels/Enhancement","name":"Enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-03-24T16:53:35Z","updated_at":"2015-06-12T00:33:16Z","closed_at":null,"body":"Here's a roadmap for getting better aligned with OpenID Connect and OAuth 2:\n\n- [ ] Split h.auth (Identity) and h.api.auth (Storage)\n- [ ] Identity server should return an ID Token from its authentication flow.\n  - [ ] OPTIONAL an Access Token may be returned _may be the same as ID Token iff both are JWTs_\n- [x] Storage should accept ID Tokens in exchange for Access Tokens (_may be the same iff both are JWTs)\n\nThere are two relationships happening:\n\n1. Client and Identity Server are doing OIDC authentication.\n2. Client and Storage Server are doing OAuth2 authorization.\n\nThese are two _separate_ interactions. It is tempting to try to think of them all as part of one flow, but the most reasonable way to connect both while maintaining some alignment with specifications for the sake of interoperability.\n\nIn this case, we happen to be implementing a Storage Server that supports JWTs as Authorization Grants, and providing our Identity Token to it so that the second flow is one round trip. The Storage Server can provide storage namespaced (via our `consumer` key in storage) to each issuer it knows about.\n\nDown the road, an ideal client might wish to engage in OIDC discovery to allow adding identities. The discovery of the preferred Storage Server for any identity is out of scope for now and we should do whatever works.\n\n<!---\n@huboard:{\"order\":0.01171875}\n-->\n"},"comment":{"url":"https://api.github.com/repos/hypothesis/h/issues/comments/111314522","html_url":"https://github.com/hypothesis/h/issues/2084#issuecomment-111314522","issue_url":"https://api.github.com/repos/hypothesis/h/issues/2084","id":111314522,"user":{"login":"tilgovi","id":20818,"avatar_url":"https://avatars.githubusercontent.com/u/20818?v=3","gravatar_id":"","url":"https://api.github.com/users/tilgovi","html_url":"https://github.com/tilgovi","followers_url":"https://api.github.com/users/tilgovi/followers","following_url":"https://api.github.com/users/tilgovi/following{/other_user}","gists_url":"https://api.github.com/users/tilgovi/gists{/gist_id}","starred_url":"https://api.github.com/users/tilgovi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tilgovi/subscriptions","organizations_url":"https://api.github.com/users/tilgovi/orgs","repos_url":"https://api.github.com/users/tilgovi/repos","events_url":"https://api.github.com/users/tilgovi/events{/privacy}","received_events_url":"https://api.github.com/users/tilgovi/received_events","type":"User","site_admin":false},"created_at":"2015-06-12T00:33:16Z","updated_at":"2015-06-12T00:33:16Z","body":"I removed all the partner labels to avoid any perception of favoritism in this tracker and a preference for tracking partner needs in product planning rather than individual technical issues."}}