{"action":"created","issue":{"url":"https://api.github.com/repos/ory/hydra/issues/772","repository_url":"https://api.github.com/repos/ory/hydra","labels_url":"https://api.github.com/repos/ory/hydra/issues/772/labels{/name}","comments_url":"https://api.github.com/repos/ory/hydra/issues/772/comments","events_url":"https://api.github.com/repos/ory/hydra/issues/772/events","html_url":"https://github.com/ory/hydra/issues/772","id":295509966,"number":772,"title":"oauth2: Improving the consent flow design","user":{"login":"arekkas","id":3372410,"avatar_url":"https://avatars3.githubusercontent.com/u/3372410?v=4","gravatar_id":"","url":"https://api.github.com/users/arekkas","html_url":"https://github.com/arekkas","followers_url":"https://api.github.com/users/arekkas/followers","following_url":"https://api.github.com/users/arekkas/following{/other_user}","gists_url":"https://api.github.com/users/arekkas/gists{/gist_id}","starred_url":"https://api.github.com/users/arekkas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arekkas/subscriptions","organizations_url":"https://api.github.com/users/arekkas/orgs","repos_url":"https://api.github.com/users/arekkas/repos","events_url":"https://api.github.com/users/arekkas/events{/privacy}","received_events_url":"https://api.github.com/users/arekkas/received_events","type":"User","site_admin":false},"labels":[{"id":386988173,"url":"https://api.github.com/repos/ory/hydra/labels/breaking-change","name":"breaking-change","color":"b60205","default":false},{"id":214764871,"url":"https://api.github.com/repos/ory/hydra/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":{"login":"arekkas","id":3372410,"avatar_url":"https://avatars3.githubusercontent.com/u/3372410?v=4","gravatar_id":"","url":"https://api.github.com/users/arekkas","html_url":"https://github.com/arekkas","followers_url":"https://api.github.com/users/arekkas/followers","following_url":"https://api.github.com/users/arekkas/following{/other_user}","gists_url":"https://api.github.com/users/arekkas/gists{/gist_id}","starred_url":"https://api.github.com/users/arekkas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arekkas/subscriptions","organizations_url":"https://api.github.com/users/arekkas/orgs","repos_url":"https://api.github.com/users/arekkas/repos","events_url":"https://api.github.com/users/arekkas/events{/privacy}","received_events_url":"https://api.github.com/users/arekkas/received_events","type":"User","site_admin":false},"assignees":[{"login":"arekkas","id":3372410,"avatar_url":"https://avatars3.githubusercontent.com/u/3372410?v=4","gravatar_id":"","url":"https://api.github.com/users/arekkas","html_url":"https://github.com/arekkas","followers_url":"https://api.github.com/users/arekkas/followers","following_url":"https://api.github.com/users/arekkas/following{/other_user}","gists_url":"https://api.github.com/users/arekkas/gists{/gist_id}","starred_url":"https://api.github.com/users/arekkas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arekkas/subscriptions","organizations_url":"https://api.github.com/users/arekkas/orgs","repos_url":"https://api.github.com/users/arekkas/repos","events_url":"https://api.github.com/users/arekkas/events{/privacy}","received_events_url":"https://api.github.com/users/arekkas/received_events","type":"User","site_admin":false},{"login":"zepatrik","id":5354445,"avatar_url":"https://avatars2.githubusercontent.com/u/5354445?v=4","gravatar_id":"","url":"https://api.github.com/users/zepatrik","html_url":"https://github.com/zepatrik","followers_url":"https://api.github.com/users/zepatrik/followers","following_url":"https://api.github.com/users/zepatrik/following{/other_user}","gists_url":"https://api.github.com/users/zepatrik/gists{/gist_id}","starred_url":"https://api.github.com/users/zepatrik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zepatrik/subscriptions","organizations_url":"https://api.github.com/users/zepatrik/orgs","repos_url":"https://api.github.com/users/zepatrik/repos","events_url":"https://api.github.com/users/zepatrik/events{/privacy}","received_events_url":"https://api.github.com/users/zepatrik/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/ory/hydra/milestones/18","html_url":"https://github.com/ory/hydra/milestone/18","labels_url":"https://api.github.com/repos/ory/hydra/milestones/18/labels","id":2767997,"number":18,"title":"1.0.0-alpha.1","description":"","creator":{"login":"arekkas","id":3372410,"avatar_url":"https://avatars3.githubusercontent.com/u/3372410?v=4","gravatar_id":"","url":"https://api.github.com/users/arekkas","html_url":"https://github.com/arekkas","followers_url":"https://api.github.com/users/arekkas/followers","following_url":"https://api.github.com/users/arekkas/following{/other_user}","gists_url":"https://api.github.com/users/arekkas/gists{/gist_id}","starred_url":"https://api.github.com/users/arekkas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arekkas/subscriptions","organizations_url":"https://api.github.com/users/arekkas/orgs","repos_url":"https://api.github.com/users/arekkas/repos","events_url":"https://api.github.com/users/arekkas/events{/privacy}","received_events_url":"https://api.github.com/users/arekkas/received_events","type":"User","site_admin":false},"open_issues":10,"closed_issues":48,"state":"open","created_at":"2017-09-15T11:10:29Z","updated_at":"2018-04-08T14:01:23Z","due_on":null,"closed_at":null},"comments":27,"created_at":"2018-02-08T13:23:04Z","updated_at":"2018-04-18T18:34:48Z","closed_at":null,"author_association":"OWNER","body":"As part of our efforts to become OpenID Connect Certified, we are improving the consent flow and working on various issues such as #720 #692 #697. Please engage with this issue and help us find the best solution.\r\n\r\n## The state of the consent flow as of today\r\n\r\nThe consent flow's intention is receiving a user's authorization for granting an access token on the user's behalf. The access token has a subset of the user's permissions (scopes). To identify the user, the consent app typically requires prior authentication. So usually, the flow looks like this:\r\n\r\n1. Hydra receives an OAuth 2.0 Authorization request\r\n2. Hydra redirects the user agent to the consent app\r\n3. The consent app validates the user's session, or if no session exists requires the user to log in\r\n4. After successful authentication, the consent app asks the user to grant certain permissions to the client that initiated the request\r\n5. After successful consent, the consent app redirects the user back to Hydra\r\n6. Hydra issues the tokens and so on.\r\n\r\nThis flow has several advantages:\r\n\r\n1. The developer is free to implement the login and consent screen with whatever programming language and tools.\r\n2. The identity management is completely left out of Hydra.\r\n\r\nBut, this flow has several disadvantages as well:\r\n\r\n1. The consent app needs to be aware of certain OpenID Connect concepts, such as reserved scopes (email, profile, ...)\r\n2. It is not possible to skip the consent screen in the consent app, as the consent app does not know if the user already authorized this application before - without managing this state itself\r\n3. It is not possible for hydra to just ask for consent (`prompt=consent`)\r\n\r\nWhile the aforementioned limitations are resolvable by leaving this to the developer, it makes integration harder than it should be, and opens up potential for bugs and vulnerabilities. Here is a (work in progress) state diagram that shows what an industry-standard OpenID Connect consent app would need to do:\r\n\r\n![image](https://user-images.githubusercontent.com/3372410/35973156-a74251f4-0cd4-11e8-9a18-14d980b03610.png)\r\n\r\nWhile it is possible to disregard some of those features, such as\r\n\r\n* Remembering previous consent\r\n* Remembering previous authentication\r\n\r\nit results in worse user and developer experience. The diagram for such an app would look like this:\r\n\r\n![image](https://user-images.githubusercontent.com/3372410/35973197-d147c34e-0cd4-11e8-8a62-4c0a08e2d04f.png)\r\n\r\nIt's less work, but it's still work. It still needs to understand and handle certain scopes, and so on.\r\n\r\nWe think that the most sane approach, that improves user and developer experience, is to reduce the scope of the consent app. This is outlined in the next section.\r\n\r\n## Handling consent in ORY Hydra and simplifying the consent flow\r\n\r\nThe idea of this approach is to keep the core concept of the consent flow, but use it for authentication only. Instead of the consent app needing to handle scopes and authorization, it just needs to tell Hydra who the user is and send some additional user data if OpenID Connect should be implemented. It would also mean that the consent app would be renamed to \"Identity Provider\", \"Login Provider\" or \"Identity Management\".\r\n\r\nLet's start off with a bit of terminology:\r\n\r\n* Authorization Server (AS): This is ORY Hydra\r\n* Login Provider (LP): This is the consent app, but it is only handling user authentication, not scopes or anything like that.\r\n* Authentication Request (AR): This is what the consent request was previously. It's a unique ID that is generated by ORY Hydra.\r\n* Authentication Flow: This is the consent flow, but renamed to better reflect what is happening.\r\n* Client App: This is some OAuth2 Client App that wants an access token and that performs the authorize code flow, or the implicit flow.\r\n\r\nA high level overview of the authentication flow would look like this:\r\n\r\n![https://mermaidjs.github.io/mermaid-live-editor/#/edit/Z3JhcGggVEQKQ0F7Q2xpZW50IEFwcH0gLS0-fEluaXRpYWxpemVzIEF1dGhvcml6YXRpb24gQ29kZSBGbG93IG9yIEltcGxpY2l0IEZsb3d8QVN7T1JZIEh5ZHJhfQpBUy0tPnxJbml0aWF0ZXMgYXV0aGVudGljYXRpb24gcmVxdWVzdCBhbmQgcmVkaXJlY3RzIHVzZXIgYWdlbnQgdG8gTFB8TFB7TG9naW4gUHJvdmlkZXJ9CkxQLS0-TFBDKENoZWNrIGZvciBBUiBJRCBpbiB1cmwgcXVlcnkgYD9hdXRoZW50aWNhdGlvblJlcXVlc3Q9JGlkYCkKTFBDLS0-fEFSIElEIGlzIG5vdCBzZXR8RXJyKE5vdGlmeSB1c2VyIHdpdGggZXJyb3IgbWVzc2FnZSkKTFBDLS0-fEFSIElEIGlzIHNldHxMUEcoRmV0Y2ggYXV0aGVudGljYXRpb24gcmVxdWVzdCBpbmZvIGZyb20gSHlkcmEgdXNpbmcgJGlkKQpMUEctLT5MT0dJTihBc2sgdXNlciB0byBsb2cgaW4pCkxPR0lOLS0-fHVuc3VjY2Vzc2Z1bHwgTE9HSU4KTE9HSU4tLT58c3VjY2Vzc2Z1bHwgR1JBTlQoU2VuZCB1c2VyIElEIGFuZCBkYXRhIHRvIE9SWSBIeWRyYSkKR1JBTlQtLT5FTkQoUmVkaXJlY3QgdXNlciBhZ2VudCB0byByZWRpcmVjdFVybCBmcm9tIGF1dGhlbnRpY2F0aW9uIHJlcXVlc3QgcGF5bG9hZCk](https://user-images.githubusercontent.com/3372410/35974578-eaccf014-0cd9-11e8-8586-fea805af0d46.png)\r\n\r\nNow, Hydra has all the information required to finish the authorization flow. As a next step, Hydra would show some ui where the user is asked for permission to grant the application access to the set of scopes.\r\n\r\nIt is obvious, that this is much less work for the developer, it has fewer pieces which can go wrong, and it's much easier to integrate.\r\n\r\nLet's come to the tricky parts next. ORY Hydra was originally designed with a \"no-ui\" mantra. Over the lifespan of the project however, we discovered that it's not that easy. There are certain ui pages that are necessary, such as errors during the authorization flow. While we were able to offset these errors by delegating them to the consent app, it was not a very clean concept.\r\n\r\nThe core idea behind \"no-ui\" is to leave the UI implementation 100% to the developer integrating with ORY Hydra. UI can be tricky:\r\n\r\n* Typically, the UI should look like every other page on the website - it should integrate in the CI\r\n* UIs need to handle different locales\r\n* Developers may want to display additional things (e.g. data)\r\n\r\nUnfortunately, this concept inhibits the ability to be 100% OpenID Connect compliant and complicates the integration of ORY Hydra.\r\n\r\nAs a result, we are discussing if we should implement the flow shown above, and serve the html ui for the consent screen in ORY Hydra. So far, we have identified the following features that would be required for this to work properly:\r\n\r\n* [ ] The developer must be able to replace or modify the consent screen HTML template\r\n* [ ] The developer must be able to serve custom CSS or even JS for the consent screen.\r\n* [ ] The developer must be able to add human-readable titles and descriptions for scopes.\r\n* [ ] It must be possible to add translations for scope titles and descriptions and show these translations according to the requested  locale.\r\n* [ ] It must be possible to translate arbitrary text (e.g. \"Authorize Application\")\r\n* [ ] It must be possible to log out of a session in the consent screen, given that the user changed. Log out should destroy session data and re-initialize the authentication flow\r\n\r\nThis is what we have so far. Please add your comments, ideas, and alternatives below."},"comment":{"url":"https://api.github.com/repos/ory/hydra/issues/comments/382486322","html_url":"https://github.com/ory/hydra/issues/772#issuecomment-382486322","issue_url":"https://api.github.com/repos/ory/hydra/issues/772","id":382486322,"user":{"login":"kavuri","id":2538487,"avatar_url":"https://avatars0.githubusercontent.com/u/2538487?v=4","gravatar_id":"","url":"https://api.github.com/users/kavuri","html_url":"https://github.com/kavuri","followers_url":"https://api.github.com/users/kavuri/followers","following_url":"https://api.github.com/users/kavuri/following{/other_user}","gists_url":"https://api.github.com/users/kavuri/gists{/gist_id}","starred_url":"https://api.github.com/users/kavuri/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kavuri/subscriptions","organizations_url":"https://api.github.com/users/kavuri/orgs","repos_url":"https://api.github.com/users/kavuri/repos","events_url":"https://api.github.com/users/kavuri/events{/privacy}","received_events_url":"https://api.github.com/users/kavuri/received_events","type":"User","site_admin":false},"created_at":"2018-04-18T18:34:48Z","updated_at":"2018-04-18T18:34:48Z","author_association":"NONE","body":"I agree with @p-bakker on a sample app for consent flow (with a reference UI) for a quick start will immensely help to get a grasp of the internal details. Are these API end-points available now? I am looking at hydra-consent-app-express for a quick start"}}
{"actor":{"display_login":"kavuri"}}