<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 2022-05 -09, at 14:27, Mark Taylor <<a href="mailto:M.B.Taylor@bristol.ac.uk" class="">M.B.Taylor@bristol.ac.uk</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">If VO service providers mostly or all decide that such arrangements</span><br style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">are unacceptable and that desktop clients must use browser-based</span><br style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">flows in order to authenticate, then yes some of these details</span><br style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">won't be much use. However, even in that case and supposing I'm</span><br style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">prepared to implement a browser-based flow, as a client author</span><br style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">I still don't know how to go from a bare "www-authenticate: bearer"</span><br style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">challenge to finding out where I can go to get a suitable bearer</span><br style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">token, so I still don't know how to offer the user a browser-based</span><br style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">authentication flow. Are there standardised rules about redirection</span><br style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">flows that could enable me to work that out?</span><br style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""></div></blockquote></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">The point I was trying to make is that I think the intention is that you do not start at the </div><div class="">“bare www-authenticate:bearer” challenge - after all browsers would have the same problem - the first step is that a redirect is issued to the URL of the token issuer. Then a call is made to the token issuer with one of the parameters being a callback URL that the token issuer then emits a redirect to with the token. I agree that it is fairly unclear amongst the standards what the browser is supposed to do if it gets a www-authenticate:bearer challenge. My guess is that the standards authors imagined that the body of the response might contain an error message with a suitable link that the user might click on, but because it is so ill-defined it is an “error condition” that has occurred when a token expires or is invalid. In the case of expiry, depending on the style of token, it might be possible to refresh the token without user intervention, but in that case I think that the expectation is that the app/browser has remembered the token generation URL or that it is well known in some way.</div><div class=""><br class=""></div><div class="">I also agree that having to interact between a native app and a web browser is not going to be elegant given the sandboxing.</div><div class=""><a href="https://developers.google.com/identity/protocols/oauth2/native-app" class="">https://developers.google.com/identity/protocols/oauth2/native-app</a> gives some examples and makes reference to <a href="https://datatracker.ietf.org/doc/html/rfc8252" class="">https://datatracker.ietf.org/doc/html/rfc8252</a>, and it seems that “custom URI schemes” are probably the favoured method at the moment, given the furore when Zoom tried to use "loopback interface redirection”. Although, I think that they just left a web server running continuously rather than follow the advice <a href="https://datatracker.ietf.org/doc/html/rfc8252#section-8.3" class="">https://datatracker.ietf.org/doc/html/rfc8252#section-8.3</a>.</div><div class=""><br class=""></div><div class="">Cheers,</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>Paul.</div></body></html>