Adding support for OAuth 2.1 for JWT-based authentication - #824
ocampana-videotec wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
OAuth2.1 addition to 2.0 mainly requires use of PKCE between browser and authorization server. The changes do not affect ONVIF devices so no normative consequences.
Generally suggest to defer this PR until OAuth2.1 RFC is released as ONVIF should not rely on draft specifications. As alternative we might mention RFC 7636 in the informative section 4.6.2 User authentication and authorization.
Some details:
- PKCE acronym is defined but never used.
- New capability should be a capability and not a method
Yes, this is exactly my idea, because I expect that OAuth 2.1 will be released before the Agentic Service. |
3 participants
I am extracting this part from the draft PR #809 just to focus on the impact of adding OAuth 2.1 for JWT based authentication on the Security Service.
Based on my analysis, almost nothing changes. Things are different if we want also to extend the generation of OAuth 2.1 JWTs, so that the device can for example push recorded video to the cloud.