Authentication scheme for HMAC authentication in Restful services.

Unmesh Joshi <[email protected]> Tue, 18 Jun 2013 17:23:19 +0530
Newsgroups gmane.comp.web.services.rest
Message-ID <CAOk+zfffMVtRevZvaOR7j-MLWi7dg+Hh9PObNBNfvbHUm=Ee8A@mail.gmail.com>
Hi,

We have implemented a Restful service with HMAC authentication. Till now,
we were using custom authorization header. But it looks like the common
practice is to use standard HTTP "Authorization" header with custom
authorization scheme.
Unfortunately there doesnt seem to be a standard scheme so far for HMAC
based authentication. Everyone (Amazon, Azure, etc..) use their own schemes
(e.g. "AWS" used by Amazon or "SharedKey""SharedLiteKey" used by Azure
http://msdn.microsoft.com/en-us/library/dd179428.aspx). All these schemes
are nearly same, but use different scheme identifier.

http://tools.ietf.org/html/draft-ietf-httpbis-p7-auth-22 seems to work in
progress, but there is no place where all the commonly used authentication
schemes are listed.

I found this https://github.com/hueniverse/hawk<https://github.com/hueniverse/hawk#security-considerations>.
But not sure if this is widely used.

I do not want to create a new scheme identifier, something more generic
will probably make sense.
Thoughts?

Thanks,
Unmesh