<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Jun 10, 2020, at 11:21 PM, Marcel Taeumel wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div id="__MailbirdStyleContent" style="font-size: 10pt;font-family: Arial;color: #000000"> Hi Tim,<div><br></div><div>thank you for sharing your efforts!</div><div><br></div><div>> <span style="font-family: Arial, Helvetica, sans-serif;font-size: 13px">But it's also slightly less </span><span style="font-family: Arial, Helvetica, sans-serif;font-size: 13px">complex than Zinc-SSO because I only left in the bits that support </span><span style="font-family: Arial, Helvetica, sans-serif;font-size: 13px">Google's OAuth2.</span></div><div><br></div><div>I suppose that generic support for OAuth2 would be gold for Squeak Trunk. :-) Maybe with a simple way to add more service providers besides Google... GitLab, GitHub, Discord, Reddit, Bitbucket, ... </div></div></blockquote><br></div><div>Thank you Marcel!</div><div><br></div><div>It has been a year since I was deep into this project, but I'll try to add some detail regarding its potential usefulness in Trunk:</div><div><br></div><div>As it is, this code implements the interactive, browser-based method of OAuth2. This means it requires a browser to open up and for a human to physically log in. It is likely possible for Squeak to launch the browser and then capture the token, as I have seen done in Python. (The token would eventually expire, of course.)</div><div><br></div><div>It is useful for SSO. But for automated workflows, where human intervention is undesired, there is another type of OAuth2 which may be called "server to server" or apparently "two-legged OAuth":</div><div><br></div><div><a href="https://developers.google.com/identity/protocols/oauth2/service-account">https://developers.google.com/identity/protocols/oauth2/service-account</a></div><div><br></div><div>I tried and failed to implement this last year. Where I failed was in computing the JSON Web Signature (JWS). I could generate JWTs successfully*, but JWSs for Google require "SHA256withRSA (also known as
RSASSA-PKCS1-V1_5-SIGN with the SHA-256 hash function)" which requires one very specific algorithm missing from SqueakSSL and which I simply could not engineer on my own at the time (or perhaps ever — I might just not be smart enough ;) ). I was able to get as far as crafting the JSON in Squeak and then signing using Python's implementation of the algorithm and it would work.</div><div><br></div><div>If we could get server-to-server OAuth2 using WebClient, that would also allow us to, say, connect to Google Drive directly from Squeak, or be a client of Google Cloud Platform / Compute Engine, etc. I think that would be very cool.</div><div><br></div><div>Sadly, I seem to recall this type of OAuth (and thus this algorithm) would also be necessary for GitHub/GitLab.</div><div><br></div><div>Best,</div><div>a Tim</div><div><br></div><div><br></div><div>* I think I made a class for this which I could contribute.</div><div><br></div><br></body></html>