Skip to main content

Authentication and Authorization for Constrained Environments Using OAuth and UMA

Document Type Expired Internet-Draft (individual)
Expired & archived
Authors Hannes Tschofenig , Eve Maler , Erik Wahlstroem , Samuel Erdtman
Last updated 2015-09-10 (Latest revision 2015-03-09)
RFC stream (None)
Intended RFC status (None)
Stream Stream state (No stream defined)
Consensus boilerplate Unknown
RFC Editor Note (None)
IESG IESG state Expired
Telechat date (None)
Responsible AD (None)
Send notices to (None)

This Internet-Draft is no longer active. A copy of the expired Internet-Draft is available in these formats:


Authentication and authorization are fundamental security features used in Internet and Web applications. Providing the same level of security functionality to the Internet of Things (IoT) environment as well is a logical enhancement and reduces the risk of unauthorized access to personal data. IoT devices, however, have limitations in terms of processing power, memory, user interface, Internet connectivity, etc. Since many use cases span Web and IoT environments and the question of "Web" vs. "IoT" can in some cases be considered a continuum, it is required to find security solutions that can accommodate the capabilities and constraints of both environments without significant compromises. Thus, an approach of adapting already standardized and deployed authentication and authorization technologies is worth examining. This document describes how the Web Authorization Protocol (OAuth) in combination with User-Managed Access (UMA) can be used for an IoT environment to bring Web-scale authorization services to the IoT world.


Hannes Tschofenig
Eve Maler
Erik Wahlstroem
Samuel Erdtman

(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)