{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/125","labels_url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/125/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/125/comments","events_url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/125/events","html_url":"https://github.com/mozilla/fxa-oauth-server/issues/125","id":40763495,"number":125,"title":"OAuth 2.0 back end service clients","user":{"login":"ckarlof","id":2365255,"avatar_url":"https://avatars.githubusercontent.com/u/2365255?v=3","gravatar_id":"","url":"https://api.github.com/users/ckarlof","html_url":"https://github.com/ckarlof","followers_url":"https://api.github.com/users/ckarlof/followers","following_url":"https://api.github.com/users/ckarlof/following{/other_user}","gists_url":"https://api.github.com/users/ckarlof/gists{/gist_id}","starred_url":"https://api.github.com/users/ckarlof/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ckarlof/subscriptions","organizations_url":"https://api.github.com/users/ckarlof/orgs","repos_url":"https://api.github.com/users/ckarlof/repos","events_url":"https://api.github.com/users/ckarlof/events{/privacy}","received_events_url":"https://api.github.com/users/ckarlof/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mozilla/fxa-oauth-server/labels/waffle:ready","name":"waffle:ready","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2014-08-21T01:08:43Z","updated_at":"2015-04-29T08:26:49Z","closed_at":null,"body":"We're starting to have the need for flexible, scalable, and secure server <-> server communication. \r\n\r\nHere are some examples:\r\n* FxA/Basket API integration: https://github.com/mozilla/fxa-auth-server/issues/786\r\n* Getting the uid associated with an email: https://github.com/mozilla-services/loop-server/pull/183#discussion_r16509112\r\n\r\nA related issue is [helping with Marketplace's migration to FxA](https://github.com/mozilla/fxa-auth-server/issues/780).\r\n\r\nThese endpoints need authentication and permissions. I think that our OAuth infrastructure can help with this, and what I'm thinking of looks similar to [Google OAuth 2 service accounts](https://developers.google.com/accounts/docs/OAuth2ServiceAccount).\r\n\r\nService providers could generate JWT assertions to the OAuth server that request a token that grants access to certain scopes (i.e., backend endpoints). For example, if the FxA Auth server needs to notify the Basket API of a new FxA user, it would request a token from the FxA OAuth server with scope `service:basket` and use this to authenticate the request rather than current API key in use. Google service accounts use Bearer tokens, but we could explore Gryphon public keys here as well to authenticate the actual resource requests."},"comment":{"url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/comments/97351170","html_url":"https://github.com/mozilla/fxa-oauth-server/issues/125#issuecomment-97351170","issue_url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/125","id":97351170,"user":{"login":"ametaireau","id":67073,"avatar_url":"https://avatars.githubusercontent.com/u/67073?v=3","gravatar_id":"","url":"https://api.github.com/users/ametaireau","html_url":"https://github.com/ametaireau","followers_url":"https://api.github.com/users/ametaireau/followers","following_url":"https://api.github.com/users/ametaireau/following{/other_user}","gists_url":"https://api.github.com/users/ametaireau/gists{/gist_id}","starred_url":"https://api.github.com/users/ametaireau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ametaireau/subscriptions","organizations_url":"https://api.github.com/users/ametaireau/orgs","repos_url":"https://api.github.com/users/ametaireau/repos","events_url":"https://api.github.com/users/ametaireau/events{/privacy}","received_events_url":"https://api.github.com/users/ametaireau/received_events","type":"User","site_admin":false},"created_at":"2015-04-29T08:26:49Z","updated_at":"2015-04-29T08:26:49Z","body":"We have a use case for service to service authentication: payments.\r\n\r\n- As the payments app, I want to submit new payment information for agivenuser and a specific selling app to the storage;\r\n- As the selling app (e.g. \"Mozilla concrete, selling concrete bricks\"), I want to be able to access (readonly) the purchase information for agivenuser for my application.\r\n\r\nSo, the payment application and the selling applications will all need to get access tokens to send data to the storage API."}}