<div dir="ltr">It looks like we need to both clean up and add documentation around scopes. <div><br></div><div>A scope, which is just a string, like “profile”, is a permission that is associated with a token. A token with a “profile” scope means that token has the permission to read and write the user’s profile. The authentication flow would for using such a token would be something like:</div><div><br></div><div>1) A client sends a request to the FxA Profile API, including the OAuth token as a bearer token.</div><div>2) The Profile server extracts the token, verifies it [1], and gets the lists of scopes associated with it.</div><div>3) The Profile server verifies that “profile” is on the list of scopes, which is the scope associated with the FxA Profile API. If the “profile" scope is missing, that means this token does not have the appropriate permission to use the FxA Profile API, and the request should be rejected.</div><div><br></div><div>If you want to use FxA OAuth to authenticate your API, we need to agree on a scope that represents your API, e.g., “mozstumbler”. Then, in the login flow for your app you would request the scopes “mozstumbler profile” [2]. This means when the login completes, your application would obtain a token for the user with permission to use your backend API (i.e., “mozstumbler”) and permission to use the profile API for that user (i.e., “profile”). This token can now safely be used from the mobile app (i.e., to use the mozstumbler) or from the backend. </div><div><br></div><div>A trusted relier (which I think MozStumbler would be) can currently request any scope it wants (I believe this is still the case), even if it doesn’t exist yet. Longer term we should probably lock this down a bit, to improve error messaging at the least.</div><div><br></div><div>-chris</div><div><br></div><div>[1] FxA OAuth tokens currently must be verified online with the FxA OAuth server, but we’re working on making them locally verifiable. </div><div>[2] In OAuth, scopes are “ “ (i.e., space) separated. </div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jun 1, 2015 at 11:04 AM, Victor Ng <span dir="ltr"><<a href="mailto:vng@mozilla.com" target="_blank">vng@mozilla.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>Hmm.. ok.<br><br></div>I actually do need my phone to authenticate to the API. I'm not sure I understand OAuth scopes, or how they relate to FxA.<br><br></div><div>I think what I want is to create a 'mozstumbler' scope which has read-only access to email address. When nicknames are supported, I'd like to have read/write access to that as well. I'm currently using `profile:email` as my scope.<br><br>The part I'm confused about is how to create a new scope.<br><br>I don't see how to do that in the OAuth dashboard over at : <a href="https://oauth-stable.dev.lcip.org/console/login" target="_blank">https://oauth-stable.dev.lcip.org/console/login</a><br><br>The docs don't seem to point to how to create a new scope, and it seems to indicate that I can't create a new scope.<br><br><a href="https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Firefox_Accounts/Introduction" target="_blank">https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Firefox_Accounts/Introduction</a><br></div><div><ul><li><strong>scope</strong> - the requested scope of FxA user data or API access. Currently, only <strong>profile</strong> and related sub-scopes (e.g., <strong>profile:email</strong>) are supported.</li></ul><p>To be honest - I don't really understand why I need a new scope for devices. I think I have a gap in my understanding of what the scope is supposed to do other than restrict access to profile data.<br></p></div><div>vic<br></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jun 1, 2015 at 1:17 PM, Christopher Karlof <span dir="ltr"><<a href="mailto:ckarlof@mozilla.com" target="_blank">ckarlof@mozilla.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><span>On Fri, May 29, 2015 at 12:59 PM, Victor Ng <span dir="ltr"><<a href="mailto:vng@mozilla.com" target="_blank">vng@mozilla.com</a>></span> wrote:<br></span><div class="gmail_extra"><div class="gmail_quote"><span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>Doh. I didn't notice the reply-to doesn't go to the mailing list....<br><br>----<br><br></div><div>Thanks Remy!<br></div><div><br></div>I've got a client that seems to login
now. I get a code, I pass that into my EC2 box and in the end I end up
getting a JSON blob with a bearer token.<br><br>I'm doing something wrong when I try to fetch the user profile though. I'm doing something like this:<br><br>curl -v \<br> -H "Authorization: Bearer c004f4d49008326dc873f0d19eef9ee371c788bea0b888fb7aafa422e1d72d30" \<br> "<a href="https://oauth-stable.dev.lcip.org/v1/profile" target="_blank">https://oauth-stable.dev.lcip.org/v1/profile</a>"<br><br></div><div>Can I use that bearer token from both my phone *and* my EC2 box? How long can I expect the token to be valid for? <br><br></div></div></blockquote><div><br></div></span><div>Yes, you can use this token for talking to the FxA API from both the phone and the EC2 box. These tokens currently live indefinitely (until revoked), but we’re re-working the policies around this. </div><div><br></div><div>This token is not appropriate for authenticating a phone to *your API*, unless it has an OAuth scope associated with it for your service. That’s something worth considering, though (i.e., adding a scope for your API), because then you wouldn’t need an additional authentication mechanism. </div><div><br></div><div>-chris</div><div><div><div><br></div><div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div></div>vic<div><div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, May 20, 2015 at 3:58 AM, Rémy Hubscher <span dir="ltr"><<a href="mailto:rhubscher@mozilla.com" target="_blank">rhubscher@mozilla.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
Hello Vic,<br>
<br>
So basically all you want to do is to get the user id after the
login, is that right?<br>
<br>
If I get it right, all you have to do is to register a client to
Firefox Account (you can do it yourself for development here:
<a href="https://oauth-stable.dev.lcip.org/console/clients" target="_blank">https://oauth-stable.dev.lcip.org/console/clients</a> (log with a
@<a href="http://mozilla.com" target="_blank">mozilla.com</a> email))<br>
<br>
<br>
All the steps are defined here:
<a href="https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Firefox_Accounts/Introduction" target="_blank">https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Firefox_Accounts/Introduction</a><br>
<br>
The login flow is the following:<br>
<br>
<ol>
<li>You open a browser view with the Firefox Account login page
asking for a list of scopes (in your case it might be <b>mozstumbler</b>)
If you need the email you may ask <b>profile:email</b> as well</li>
<ol>
<li>You give a <b>state</b>, the <b>scope</b>s and your <b>client_id</b></li>
<li>See
<a href="https://github.com/mozilla/fxa-oauth-server/blob/master/docs/api.md#get-v1authorization" target="_blank">https://github.com/mozilla/fxa-oauth-server/blob/master/docs/api.md#get-v1authorization</a><b><br>
</b></li>
</ol>
<li>Then the user logs in and is redirected to your service with a
<b>code</b> and a <b>state</b> (a session that you gave him)</li>
<li>Then you talk to the Firefox Account server to exchange this
code and state with a access token.</li>
<ol>
<li>See
<a href="https://github.com/mozilla/fxa-oauth-server/blob/master/docs/api.md#post-v1token" target="_blank">https://github.com/mozilla/fxa-oauth-server/blob/master/docs/api.md#post-v1token</a><br>
</li>
</ol>
<li>This bearer token give you access to the FxA user id as well
as the email if you need it.</li>
<ol>
<li><a href="https://github.com/mozilla/fxa-profile-server/blob/master/docs/API.md#get-v1email" target="_blank">https://github.com/mozilla/fxa-profile-server/blob/master/docs/API.md#get-v1email</a><br>
</li>
</ol>
<li>You must also validate that this Bearer token have got the <b>mozstumbler</b>
scope<br>
</li>
</ol>
<br>
Since you are in an Android app, you will need to setup a redirect
url that will be catched by your app after the login so that you get
back the code and state and can handle them. (See
<a href="http://stackoverflow.com/a/2958870/186202" target="_blank">http://stackoverflow.com/a/2958870/186202</a>)<br>
<br>
Hope this helps you,<br>
<br>
Rémy<div><div><br>
<br>
<br>
<div>Le 19/05/2015 22:16, Victor Ng a
écrit :<br>
</div>
</div></div><blockquote type="cite"><div><div>
<div dir="ltr">
<div>
<div>Hi!<br>
<br>
</div>
We'd like to look at getting FxA integration into the mozilla
stumbler, but I'm pretty confused as to what I actually need
to do.<br>
<br>
</div>
<div>The use case we have is that we are launching localized
leaderboards. Basically - geographically scoped score
boards. <br>
<br>
The intent here is to login to the mobile application - not a
particular web service.<br>
</div>
<div><br>
</div>
<div>The name of our app is "Mozilla Stumbler"<br>
<br>
We're running our dev leaderboard instance on : <a href="http://ec2-52-1-93-147.compute-1.amazonaws.com" target="_blank">ec2-52-1-93-147.compute-1.amazonaws.com</a>
, we can set the redirect_uri to whatever makes sense or is
defacto standard for FxA.<br>
<br>
</div>
<div><br>
</div>
<div>thanks!<br>
</div>
vic<br>
</div>
<br>
<fieldset></fieldset>
<br>
</div></div><span><pre>_______________________________________________
Dev-fxacct mailing list
<a href="mailto:Dev-fxacct@mozilla.org" target="_blank">Dev-fxacct@mozilla.org</a>
<a href="https://mail.mozilla.org/listinfo/dev-fxacct" target="_blank">https://mail.mozilla.org/listinfo/dev-fxacct</a>
</pre>
</span></blockquote>
<br>
</div>
<br>_______________________________________________<br>
Dev-fxacct mailing list<br>
<a href="mailto:Dev-fxacct@mozilla.org" target="_blank">Dev-fxacct@mozilla.org</a><br>
<a href="https://mail.mozilla.org/listinfo/dev-fxacct" target="_blank">https://mail.mozilla.org/listinfo/dev-fxacct</a><br>
<br></blockquote></div><br></div></div></div></div>
<br>_______________________________________________<br>
Dev-fxacct mailing list<br>
<a href="mailto:Dev-fxacct@mozilla.org" target="_blank">Dev-fxacct@mozilla.org</a><br>
<a href="https://mail.mozilla.org/listinfo/dev-fxacct" target="_blank">https://mail.mozilla.org/listinfo/dev-fxacct</a><br>
<br></blockquote></div></div></div><br></div></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>