Introduction to Open Web Protocols (Open ID, OAuth, Atompub and OpenSocial) <ul><li>Mohanaraj Gopala Krishnan </li></ul><u...
Questions for you <ul><li>Experience using or developing any of the following services ? </li></ul><ul><ul><li>OpenID, Oau...
What do we mean by the Open Web ? http://www.flickr.com/photos/mag3737/1914076277
The open web is a set of philosophies <ul><li>Decentralization  - not owned by any one company  </li></ul><ul><li>Transpar...
Not about technologies &quot;...However,  if we define  the Open Web  in terms of these  technologies , then we  risk losi...
Having said that, <ul><li>This is a talk about the web specifications that embody those philosophies </li></ul><ul><li>Ope...
What is OpenID ? <ul><li>OpenID is a specification that allows people to log into a web site using credentials provided by...
Key concepts <ul><li>User </li></ul><ul><li>Identifier - unique identifier that will be reused at all sites  </li></ul><ul...
As an end user <ul><li>You can reuse your username and password which sites that work as relaying parties (not all IPs are...
As a developer <ul><li>Exist mature libraries for many languages </li></ul><ul><li>Build on the security expertise of othe...
OpenID flow www.johnmerrells.com/.../05/openid-diagram-1.png
 
 
 
What is OAuth? <ul><li>A simple open standard for delegated Web API authorization </li></ul><ul><li>Let other sites access...
Valet key for your web http://toyotaownersclub.com/forums/index.php?showtopic=77384
Key concepts <ul><li>End Users </li></ul><ul><ul><li>Share information between online services without disclosing password...
VS
http://www.flickr.com/photos/leelefever/133949029/
OpenID vs OAuth <ul><li>Goals are different  </li></ul><ul><ul><li>OpenID is about sharing a single identity with differen...
Love triangle End user Service  provider Consumer
http://www.flickr.com/photos/factoryjoe/2658493767/
http://www.flickr.com/photos/factoryjoe/2659323294/
http://www.flickr.com/photos/factoryjoe/2659323294/
http://www.flickr.com/photos/factoryjoe/2658497753/
As an end user, why bother? <ul><li>Never give your passwords to 3 rd  party websites </li></ul><ul><ul><li>Even if not ma...
WTF ?!
“ Passwords are not confetti.  Please stop throwing them around. Especially if they’re  not yours ” Chris Messina  http://...
As a developer, why bother? <ul><li>Large adoption - Goog, Y!, MySpace </li></ul><ul><li>Interop - Leverage the services  ...
What is the Atom publication protocol (Atompub) ? <ul><li>A manner of  updating Atom feed information on a server from a c...
Key concepts <ul><li>Is a RESTful HTTP protocol – uses HTTP “correctly” </li></ul><ul><li>Consists of  </li></ul><ul><ul><...
Allows for data beyond HTML <ul><li>The atom:content element allows for storing of more data then just HTML  </li></ul><ul...
<ul><li>Microsoft as well has used it as the basis of the Live web services </li></ul>http://dev.live.com/blogs/devlive/ar...
Example
 
As a developer, why bother ? <ul><li>If you're building apps </li></ul><ul><ul><li>More web APIs are being exposed as an e...
OpenSocial <ul><li>A set of open, standard APIs for building social applications </li></ul><ul><ul><li>Widget/ Portal base...
Examples http://www.flickr.com/photos/29501676@N00/1826112130/
<ul><li>http://apps.myspace.com </li></ul><ul><li>~ 1000+ apps </li></ul>
iGoogle – a non social site OpenSocial container
Google Friend Connect – A hosted OpenSocial solution
Applications  available as part of Google Friend  connect
Deals with proliferation of online social sites http://widgetsummit.com/media/slides/opensocial.pd f -  Chris Schalk, Goog...
http://widgetsummit.com/media/slides/opensocial.pd f -  Chris Schalk, Google Developer Advocate   Paul Lindner, Engineerin...
http://widgetsummit.com/media/slides/opensocial.pd f -  Chris Schalk, Google Developer Advocate   Paul Lindner, Engineerin...
Key concepts <ul><li>Platforms that can run the OpenSocial widgets are called “containers” </li></ul><ul><li>The container...
http://widgetsummit.com/media/slides/opensocial.pd f -  Chris Schalk, Google Developer Advocate   Paul Lindner, Engineerin...
http://widgetsummit.com/media/slides/opensocial.pd f -  Chris Schalk, Google Developer Advocate   Paul Lindner, Engineerin...
As a developer, why bother ? <ul><li>If you're building apps for social networks </li></ul><ul><ul><li>Huge deployment </l...
<ul><li>If you're building a web app </li></ul><ul><li>Provide social features in your software </li></ul><ul><ul><li>Auto...
<ul><li>Leverage existing implementations </li></ul><ul><ul><li>Apache shindig   </li></ul></ul><ul><ul><ul><li>http://inc...
Summary  <ul><li>The technologies are being built on top of each other – Open Web stack – many more interesting open web s...
<ul><li>Great engineering work, learnings applicable outside of original use cases </li></ul><ul><li>Community driven spec...
Thank you!
Upcoming SlideShare
Loading in …5
×

Introduction To Open Web Protocols

4,199 views

Published on

In this presentation I provide a gentle introduction to successful open web protocols such as OpenID, OAuth, Atompub and OpenSocial in terms of what they provide as well as how they can be useful to developers. Presented at the inaugural MSCOSCON 2009 in Malaysia.

Note: This presentation draws from a lot of existing content online and I have attempted to ensure that the sources have copyright that allowed reuse as well as all sources have been duly attributed. If there is any attribution missing or misuse of content please do contact me and I will rectify it.

Published in: Technology
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
4,199
On SlideShare
0
From Embeds
0
Number of Embeds
24
Actions
Shares
0
Downloads
43
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide
  • Introduction To Open Web Protocols

    1. 1. Introduction to Open Web Protocols (Open ID, OAuth, Atompub and OpenSocial) <ul><li>Mohanaraj Gopala Krishnan </li></ul><ul><li>MSCOSCONF 2 June 2009 </li></ul><ul><li>mohangk.org/blog </li></ul><ul><li>@mohangk on twitter </li></ul>
    2. 2. Questions for you <ul><li>Experience using or developing any of the following services ? </li></ul><ul><ul><li>OpenID, Oauth, Atompub or OpenSocial ? </li></ul></ul><ul><li>Might not even know about it ? </li></ul><ul><ul><li>Under the hood technologies </li></ul></ul><ul><ul><ul><li>User your Gmail / Yahoo password on more then one site ? </li></ul></ul></ul><ul><ul><ul><li>Use a twitter client that makes you login via twitter website ? </li></ul></ul></ul><ul><ul><ul><li>Blog using a client – e.g. Windows Live Writer </li></ul></ul></ul><ul><ul><ul><li>Use any of Google APIs – Gmail, Youtube, Docs </li></ul></ul></ul><ul><ul><ul><li>Use applications on Orkut, Friendster, MySpace or Ning ? </li></ul></ul></ul>
    3. 3. What do we mean by the Open Web ? http://www.flickr.com/photos/mag3737/1914076277
    4. 4. The open web is a set of philosophies <ul><li>Decentralization - not owned by any one company </li></ul><ul><li>Transparency - view the “source” </li></ul><ul><li>Openness - The protocols, docs, code or specification must be available without penalty of patents, copyright </li></ul><ul><li>User choice - As easy to leave as it was to join - take data and information with you </li></ul><ul><li>3rd Party Integration/Innovation - hook into the system at all levels, innovate without asking permission </li></ul><ul><li>Civil Society and Discourse - many-to-many and one-to-many communication, allowing for millions of conversations </li></ul>
    5. 5. Not about technologies &quot;...However, if we define the Open Web in terms of these technologies , then we risk losing sight of what makes the web special and being able to have the intellectual nimbleness to evolve the infrastructure of the web.&quot; -Brad Neuberg, Dojo, Google Gears developer http://www.flickr.com/photos/uhop/2250235637 http://codinginparadise.org/weblog/2008/04/whats-open-web-and-why-is-it-important.html
    6. 6. Having said that, <ul><li>This is a talk about the web specifications that embody those philosophies </li></ul><ul><li>Open Web technologies being developed on many fronts </li></ul><ul><ul><li>Client end </li></ul></ul><ul><ul><ul><li>Browser - Firefox – Gen Kanai's talks </li></ul></ul></ul><ul><ul><li>Server technologies </li></ul></ul><ul><ul><ul><li>Apache, PostgreSQL, Linux, BSD - tools that power the web, most mature </li></ul></ul></ul><ul><ul><li>Web specifications </li></ul></ul><ul><ul><ul><li>Driven from need for collaboration, but has value beyond it </li></ul></ul></ul>
    7. 7. What is OpenID ? <ul><li>OpenID is a specification that allows people to log into a web site using credentials provided by another web site. </li></ul><ul><li>Distributed authentication </li></ul>
    8. 8. Key concepts <ul><li>User </li></ul><ul><li>Identifier - unique identifier that will be reused at all sites </li></ul><ul><li>Identity provider (OpenID Provider, IdP, Server) </li></ul><ul><li>Relying party (Consumer) </li></ul>
    9. 9. As an end user <ul><li>You can reuse your username and password which sites that work as relaying parties (not all IPs are Rps – Facebook is the largest RP) </li></ul><ul><li>Single place to maintain/update your identity </li></ul><ul><li>Need to have an account with an identity provider </li></ul>
    10. 10. As a developer <ul><li>Exist mature libraries for many languages </li></ul><ul><li>Build on the security expertise of others </li></ul><ul><li>If you develop public websites </li></ul><ul><ul><li>OpenID as its gaining traction 500 million users, over 25,000 sites accept OpenID logins* </li></ul></ul><ul><ul><li>Makes it easier for new users to join as they do not need to re-enter all information </li></ul></ul><ul><li>If you develop internal websites </li></ul><ul><ul><li>Can use OpenID as a form of SSO for multiple internal application - looses out of the “distributed” nature however </li></ul></ul>* http://www.janrain.com/openid
    11. 11. OpenID flow www.johnmerrells.com/.../05/openid-diagram-1.png
    12. 15. What is OAuth? <ul><li>A simple open standard for delegated Web API authorization </li></ul><ul><li>Let other sites access your data without telling them your password </li></ul>
    13. 16. Valet key for your web http://toyotaownersclub.com/forums/index.php?showtopic=77384
    14. 17. Key concepts <ul><li>End Users </li></ul><ul><ul><li>Share information between online services without disclosing passwords </li></ul></ul><ul><li>Web service (Service providers) </li></ul><ul><ul><li>Allow for secure access to your API in a user controlled, secure manner </li></ul></ul><ul><li>3rd Party application (Consumers) </li></ul><ul><ul><li>A standard authorization scheme for the web </li></ul></ul>
    15. 18. VS
    16. 19. http://www.flickr.com/photos/leelefever/133949029/
    17. 20. OpenID vs OAuth <ul><li>Goals are different </li></ul><ul><ul><li>OpenID is about sharing a single identity with different consumers </li></ul></ul><ul><ul><li>OAuth is about sharing your data with different consumers without sharing your identity </li></ul></ul><ul><li>Not mutually exclusive </li></ul>
    18. 21. Love triangle End user Service provider Consumer
    19. 22. http://www.flickr.com/photos/factoryjoe/2658493767/
    20. 23. http://www.flickr.com/photos/factoryjoe/2659323294/
    21. 24. http://www.flickr.com/photos/factoryjoe/2659323294/
    22. 25. http://www.flickr.com/photos/factoryjoe/2658497753/
    23. 26. As an end user, why bother? <ul><li>Never give your passwords to 3 rd party websites </li></ul><ul><ul><li>Even if not malicious, what if compromised ? </li></ul></ul>
    24. 27. WTF ?!
    25. 28. “ Passwords are not confetti. Please stop throwing them around. Especially if they’re not yours ” Chris Messina http://www.slideshare.net/carsonified/how-oauth-and-portable-data-can-revolutionize-your-web-app-chris-messina-presentation/
    26. 29. As a developer, why bother? <ul><li>Large adoption - Goog, Y!, MySpace </li></ul><ul><li>Interop - Leverage the services </li></ul><ul><li>Can be used as a replacement for HTTP basic auth </li></ul><ul><ul><li>SSL might not be always necessary </li></ul></ul><ul><li>Part of the Open web stack </li></ul><ul><ul><li>Atompub + OpenID + OAuth + XRDS +OpenSocial </li></ul></ul>
    27. 30. What is the Atom publication protocol (Atompub) ? <ul><li>A manner of updating Atom feed information on a server from a client </li></ul><ul><li>The feed format is Atom Syndication format - RFC 4287 </li></ul><ul><li>Atom publication protocol – RFC 5023 </li></ul>
    28. 31. Key concepts <ul><li>Is a RESTful HTTP protocol – uses HTTP “correctly” </li></ul><ul><li>Consists of </li></ul><ul><ul><li>Entry – basic unit of content </li></ul></ul><ul><ul><li>Feed – a collection of entries </li></ul></ul>
    29. 32. Allows for data beyond HTML <ul><li>The atom:content element allows for storing of more data then just HTML </li></ul><ul><li>Being used as a way to expose data on the web </li></ul>Google has extended Atompub and the Atom syndication format to expose their applications data online
    30. 33. <ul><li>Microsoft as well has used it as the basis of the Live web services </li></ul>http://dev.live.com/blogs/devlive/archive/2008/02/27/213.aspx
    31. 34. Example
    32. 36. As a developer, why bother ? <ul><li>If you're building apps </li></ul><ul><ul><li>More web APIs are being exposed as an extension to Atompub or being built in a RESTful manner </li></ul></ul><ul><li>If you're exposing your building a web service/API </li></ul><ul><ul><li>Building your Web API on top of Atompub will ensure that it benefits from all the RESTful principles </li></ul></ul><ul><ul><li>Allows your users to leverage existing tooling and know how in accessing Atompub or RESTful web services </li></ul></ul>
    33. 37. OpenSocial <ul><li>A set of open, standard APIs for building social applications </li></ul><ul><ul><li>Widget/ Portal based </li></ul></ul><ul><li>Front ends are implemented in Javascript, HTML, CSS. Uses Javascript to query backends. </li></ul><ul><li>Backends expose RESTful web APIs to query backends that return data either as JSON or Atom feeds. </li></ul><ul><li>Leverages OAuth for security </li></ul>
    34. 38. Examples http://www.flickr.com/photos/29501676@N00/1826112130/
    35. 39. <ul><li>http://apps.myspace.com </li></ul><ul><li>~ 1000+ apps </li></ul>
    36. 40. iGoogle – a non social site OpenSocial container
    37. 41. Google Friend Connect – A hosted OpenSocial solution
    38. 42. Applications available as part of Google Friend connect
    39. 43. Deals with proliferation of online social sites http://widgetsummit.com/media/slides/opensocial.pd f - Chris Schalk, Google Developer Advocate Paul Lindner, Engineering Manager, hi5
    40. 44. http://widgetsummit.com/media/slides/opensocial.pd f - Chris Schalk, Google Developer Advocate Paul Lindner, Engineering Manager, hi5
    41. 45. http://widgetsummit.com/media/slides/opensocial.pd f - Chris Schalk, Google Developer Advocate Paul Lindner, Engineering Manager, hi5
    42. 46. Key concepts <ul><li>Platforms that can run the OpenSocial widgets are called “containers” </li></ul><ul><li>The containers expose a standard set of underlying data APIs </li></ul><ul><ul><li>People & Friends </li></ul></ul><ul><ul><ul><li>Access friends information programmatically </li></ul></ul></ul><ul><ul><li>Activities </li></ul></ul><ul><ul><ul><li>See what you’re friends are up to </li></ul></ul></ul><ul><ul><ul><li>Share what you are doing </li></ul></ul></ul><ul><ul><li>Persistence </li></ul></ul><ul><ul><ul><li>Provide state without a server </li></ul></ul></ul><ul><ul><ul><li>Share data with your friends </li></ul></ul></ul>
    43. 47. http://widgetsummit.com/media/slides/opensocial.pd f - Chris Schalk, Google Developer Advocate Paul Lindner, Engineering Manager, hi5 Javascript front end querying the data apis
    44. 48. http://widgetsummit.com/media/slides/opensocial.pd f - Chris Schalk, Google Developer Advocate Paul Lindner, Engineering Manager, hi5 Javascript front end accessing data from outside OpenSocial container
    45. 49. As a developer, why bother ? <ul><li>If you're building apps for social networks </li></ul><ul><ul><li>Huge deployment </li></ul></ul>375,000,000 users , 4,500+ apps, pipeline of 100+ containers world wide http://widgetsummit.com/media/slides/opensocial.pd f - Chris Schalk, Google Developer Advocate Paul Lindner, Engineering Manager, hi5
    46. 50. <ul><li>If you're building a web app </li></ul><ul><li>Provide social features in your software </li></ul><ul><ul><li>Automatically get access to all these potential gadgets </li></ul></ul><ul><ul><li>Even companies like SAP and Oracle are looking at ways to integrate social type features into their application </li></ul></ul>http://www.sapweb20.com/blog/2009/05/sap-and-open-social-at-the-google-io-developer-conference/
    47. 51. <ul><li>Leverage existing implementations </li></ul><ul><ul><li>Apache shindig </li></ul></ul><ul><ul><ul><li>http://incubator.apache.org/shindig/ </li></ul></ul></ul><ul><ul><ul><li>Being used by HI5 </li></ul></ul></ul><ul><ul><li>Glassfish socialsite </li></ul></ul><ul><ul><ul><li>https://socialsite.dev.java.net/http://incubator.apache.org/ </li></ul></ul></ul>
    48. 52. Summary <ul><li>The technologies are being built on top of each other – Open Web stack – many more interesting open web specs being developed </li></ul>http://developer.yahoo.net/blog/archives/2008/12/the_open_stack.html
    49. 53. <ul><li>Great engineering work, learnings applicable outside of original use cases </li></ul><ul><li>Community driven specifications work </li></ul><ul><ul><li>All the engineering happens on mailing lists, forums, wikis – anybody can participate, meritocratic </li></ul></ul><ul><li>Don't necessarily need to roll your own – lookout for existing open specs – participate </li></ul><ul><ul><li>If there is really a need – suggest to existing groups and get feedback </li></ul></ul>
    50. 54. Thank you!

    ×