So two questions if you've been following our #Forr2Legs tags on Twitter:
- How are your rich client apps being authenticated?
- OAuth is gaining a well-deserved reputation for bridging the gap between corporate authentication infrastructure and native apps; are you seeing it used in these settings?
I've been researching the appeal of lightweight RESTful web services as a potential new component of enterprise SOA, and especially the use of OAuth as a security mechanism for these services. Spurred by my colleague Alex Crumb, I've been using social-media channels to stimulate feedback and discussion -- open-sourcing the project, if you will.
We've been using the hashtag #Forr2Legs on Twitter, riffing off the informal nickname given to OAuth's capability for plain client-server authentication: "two-legged." However, of course, many web services act on behalf of a particular corporate user ("three-legged") rather than executing autonomously.
One of the Twitter conversation threads made me want to dig more deeply into the phenomenon of mobile apps developed and used exclusively inside the enterprise, such as shop-floor apps optimized for a tablet form factor.
I'm keen to hear about your experiences coming across these lighter-weight patterns in the context of enterprise web services security.
Finally, if you haven't read my blog post from last week, you can find the link here.
