For people interested in # ActivityPub # C2S (client to server), the # GoActivityPub services have gained the ability to dynamically register ...

submitted by

For people interested in #ActivityPub #C2S (client to server), the #GoActivityPub services have gained the ability to dynamically register OAuth2 clients based on RFC7591.

The easiest to test is the ONI project that can be directly run without much setup: git.sr.ht/~mariusor/oni

13
1

Log in to comment

Hot Top New Old

I’d generally discourage RFC7591 in decentralized systems due to the fact that it creates client sprawl (this is currently a problem with Mastodon’s client registration mechanism, which is why we created CIMDs) — every client in RFC7591 is a distinct client, with its own client_id and client_secret, which can make client management interfaces difficult to implement (e.g., every time you login on a mobile device or SPA, you’ll get a brand new client_id). CIMDs solve this by anchoring client metadata to a URI, and using that URI as the client_id.

If you need to test clients using CIMDs in development, there is cimd-service however, it’s currently targeting the AT Protocol ecosystem (so has a few specifics that at present there that would not necessarily make sense of ActivityPub)

 reply
2

@mariusor did you implement the oauth metadata endpoint also? Can clients discover the registration endpoint easily?

 reply
1
OP

@evan yes, yes, of course. :D They go hand in hand...

I remember seeing on the SWICG mailing list a comment where this mechanism is no longer considered secure, but I don't recall the details.

 reply
1

@mariusor yeah, it might be a good idea to think about CIMD. It uses the same schema of properties as dynamic registration, but you fetch them at authorization time instead. I implemented both in onepage.pub and it was pretty straightforward.

client.dev/

 reply
1

@mariusor are you coming to FOSDEM? I think we should have an ActivityPub API hackday.

 reply
1
OP

@evan as of now I don't plan to come.

But I have no other obligations for February, maybe a last minute change of heart. :D

 reply
1

@mariusor let me ask, what are your opinions on beer?

 reply
1
OP

@evan I lived in Burssels for some many years, you won't tempt me with beer. 😈

 reply
1
Continue thread
OP

@evan yes, this is the one, I realized I already added it to my ticket list: todo.sr.ht/~mariusor/go-activi

 reply
1

@mariusor this is great, I'm looking forward to testing this 🔥

 reply
1
OP

When you do, feel free to ping me with questions (here or on the mailing list).

 reply
1
Insert image