@@ -0,0 +1,31 @@
1++++
2+title = "Build a Single-Sign-On App for Urbit"
3+date = "2023-05-11"
4+
5+[taxonomies]
6+grant_type = ["RFP"]
7+grant_category = ["App Dev"]
8+
9+[extra]
10+image = ""
11+description = "Produce an OAuth-compatible token issuer and login manager."
12+reward = "TBD"
13+assignee = [""]
14+champion = [""]
15+grant_id = "P1001"
16+completed = false
17+canceled = false
18+
19++++
20+
21+OAuth has widespread support in Web 2.0 circles. OAuth issues permissioned tokens for service providers to manage sessions. There are burgeoning tools for Web3 integration.
22+
23+OAuth focuses on access delegation, meaning that one can authenticate into a third-party session using a primary identity but without giving one’s password to the third-party service provider. “OpenID is a way to use a single set of user credentials to access multiple sites, while OAuth facilitates the authorization of one site to access and use information related to the user's account on another site.”
24+
25+OAuth expects a static IP address to broker token issuance and access. There will presumably be a little bit of outside-of-Urbit tooling involved.
26+
27+Some resources that may be helpful in scoping such a project:
28+
29+- https://oauth.net/getting-started/
30+- https://www.oauth.com/oauth2-servers/getting-ready/
31+- https://www.pmail.com/devnews.htm