Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm developing a web app that will be able to access user's file on Ubuntu One.

Sites like GitHub, Twitter, Facebook, when an app request access to the user profile usually open a popup asking if you want to give the app the access while in this page about Ubuntu One API is written that I need to make a GET request with some parameters like email and password: so the user give the application not only the access but also the app can store user password which is not very secure... am I right or is there the possibility of a popup?

share|improve this question
add comment

3 Answers

That API is intended for creating desktop applications using the native widget set, rather than in-browser applications or integrating with a different site. For the latter you can do standard oauth; the user authorization url is https://one.ubuntu.com/oauth/authorize/ (you can add a description via the query), the request URL is .../request/, and access token is .../access/.

share|improve this answer
    
really the api is specified fo r Cloud application not for ubuntu or desktop based –  Matteo Pagliazzi Nov 2 '11 at 14:44
    
and what about callback url? –  Matteo Pagliazzi Nov 2 '11 at 14:45
    
@Matteo, The api is for desktop use. What part made you think otherwise? –  Chipaca Nov 2 '11 at 16:06
    
@Matteo, What about the callback url? –  Chipaca Nov 2 '11 at 16:07
    
here one.ubuntu.com/developer/account_admin/issue_tokens on the left side there is Cloud under platforms –  Matteo Pagliazzi Nov 2 '11 at 16:53
add comment

Currently Ubuntu One does not provide a way for three legged OAuth to grant third party applications to gain access to it's APIs. Your question has inspired me to file a bug (really a wish list) since it seems we are so close.

Note (and do not do this) that it is possible for your web site to collect the user's credentials to the SSO locally and then do some http requests to authenticate the user and handle the oauth dance. However, this is highly suspect and users would be just plain foolish to enter their username/password on an external site. Did I say, please don't do this? :)

share|improve this answer
    
I agree with you so I asked because since there are apis for Cloud/web apps it should be normal to have the possibility to link link an app using some official methods and not requesting directly password and username –  Matteo Pagliazzi Nov 29 '11 at 15:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.