Standard mechanism for requesting a ticket auth ticket grant?
- Dominant language
- HTML
- Stars
- 57
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
As an extension to Ticket Auth, it might be nice to optionally support the ability for someone to request a ticket to be sent to them by the provider's token endpoint. For example, if user `https://alice.example.com/` wants a ticket from `https://bob.example.com/`, then Alice could make a POST request to `https://bob.example.com/tokens` with parameters:
`grant_type=ticket_request&subject=https://alice.example.com/`
at which point Bob's token endpoint could (if supported) perform a `ticket_endpoint` discovery on Alice's profile page and then initiate the rest of the TicketAuth flow.
Alternately, this could signal Bob that there is a pending ticket request to send to Alice, and Bob can opt to continue the rest of the flow.
In effect, this would be an optional, standard "follow request" procedure, of which many developers are already baking something similar into their `grant_type=ticket` flows on their token endpoints for testing purposes.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading the Ticket Auth flow and the token endpoint behavior described in the issue. Define whether ticket_request should trigger ticket_endpoint discovery on the subject's profile or only notify the provider, and specify the complete request and completion behavior for a standard follow-request procedure.
Written by the indexing model from the issue text.
Assessment
- Domain
- api, authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100