Subject: [OAUTH-WG] GOOG1

From: "Manger, James H" <[email-masked]>
Date: Fri, 15 Oct 2010 09:29:11 +1000

I noticed that a new HTTP authentication scheme has been defined: GOOG1.

http://code.google.com/apis/storage/docs/developer-guide.html#authentication

Is this a candidate for the signature spec?

It should be the sort of scheme that OAuth core can provide credentials for (access key & secret) without the scheme needing to know about OAuth.

[It is an HMAC-SHA1; carried in the Authorization header; calculated over the method (eg GET), date, content-type, URI path (but not host or scheme), MD5-hash of request body (optional), and some proprietary headers (eg access-control details). It looks very similar to the Amazon S3 scheme.]

--

James Manger

---

From: Marius Scurtescu <[email-masked]>
Date: Wed, 27 Oct 2010 12:57:22 -0700

Hi James,

Finally got around to get an answer for your question:

"GOOG1 is an authentication scheme specific to Google Storage for
Developers, and is designed to provide interoperability with a large
number of cloud storage tools and libraries that work with services
such as Amazon Simple Storage Service (Amazon S3) and Eucalyptus
Systems, Inc.

We do not foresee this authentication scheme forming the basis of an
OAuth signature scheme."

Hope that helps.

Cheers,
Marius

On Thu, Oct 14, 2010 at 4:29 PM, Manger, James H
<[email-masked]> wrote:
> It should be the sort of scheme that OAuth core can provide credentials for
> (access key & secret) without the scheme needing to know about OAuth.
>
>
>
> [It is an HMAC-SHA1; carried in the Authorization header; calculated over
> the method (eg GET), date, content-type, URI path (but not host or scheme),
> MD5-hash of request body (optional), and some proprietary headers (eg
> access-control details). It looks very similar to the Amazon S3 scheme.]
>
>
>
>
>
> --
>
> James Manger
>
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>