# Innovating on Authentication Standards

DevFeed: [Innovating on Authentication Standards](<https://devfeed.tech/articles/innovating-on-authentication-standards-20487.md>)

Original publisher: [Read original article](<https://yahooeng.tumblr.com/post/175238642656>)

Author: mikesefanov

Published: 2018-06-25T13:59:44Z

Content type: article

Language: en

Sources: [Yahoo](<https://devfeed.tech/sources/yahoo.md>)

Topics: [Authentication](<https://devfeed.tech/topics/authentication.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [Mobile](<https://devfeed.tech/topics/mobile.md>)

Tags: [aol](<https://devfeed.tech/tags/aol.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [identity](<https://devfeed.tech/tags/identity.md>), [mobile](<https://devfeed.tech/tags/mobile.md>), [mobile-apps](<https://devfeed.tech/tags/mobile-apps.md>), [oauth2](<https://devfeed.tech/tags/oauth2.md>), [standards](<https://devfeed.tech/tags/standards.md>), [yahoo](<https://devfeed.tech/tags/yahoo.md>), [yahoo-engineering](<https://devfeed.tech/tags/yahoo-engineering.md>)

## AI overview

Yahoo and AOL describe how they used existing identity standards to address migrating identities in mobile apps from a legacy provider to the Oath identity platform. The article focuses on using OAuth 2.0 Token Exchange so apps can move between identity providers without requiring users to re-enter credentials.

## Source excerpt

yahoodevelopers: By George Fletcher and Lovlesh Chhabra When Yahoo and AOL came together a year ago as a part of the new Verizon subsidiary Oath, we took on the challenge of unifying their identity platforms based on current identity standards. Identity standards have been a critical part of the Internet ecosystem over the last 20+ years. From single-sign-on and identity federation with SAML; to the newer identity protocols including OpenID Connect, OAuth2, JOSE, and SCIM (to name a few); to the explorations of "self-sovereign identity" based on distributed ledger technologies; standards have played a key role in providing a secure identity layer for the Internet. As we navigated this journey, we ran across a number of different use cases where there was either no standard or no best practice available for our varied and complicated needs. Instead of creating entirely new standards to solve our problems, we found it more productive to use existing standards in new ways. One such use case arose when we realized that we needed to migrate the identity stored in mobile apps from the legacy identity provider to the new Oath identity platform. For most browser (mobile or desktop) use cases, this doesn't present a huge problem; some DNS magic and HTTP redirects and the user will sign in at the correct endpoint. Also it's expected for users accessing services via their browser to have to sign in now and then. However, for mobile applications it's a completely different story. The normal user pattern for mobile apps is for the user to sign in (via OpenID Connect or OAuth2) and for the app to then be issued long-lived tokens (well, the refresh token is long lived) and the user never has to sign in again on the device (entering a password on the device is NOT a good experience for the user). So the issue is, how do we allow the mobile app to move from one identity provider to another without the user having to re-enter their credentials? The solution came from researching what