10

I'm implementing an OAuth2 provider, and I would like to have an area somewhere in my web site where developers log on and register third party apps. But I'm having doubts on how to generate the apps's client identifier and client secret. Should they be unique random codes, or do they have to have some meaningful information to the client? I guess they could be random.

Well I've been looking for best practices on how to do this, but haven't found that much. So any answers will be appreciated.

PD: Im developing on .NET MVC3 with a library called DotNetOpenAuth.

Daniel
  • 2,484
  • 4
  • 27
  • 35

2 Answers2

15

The client identifier can be anything you want. It can be their choice or any random string.

The client secret should be a cryptographically strong random string. Here is how you can generate one:

RandomNumberGenerator cryptoRandomDataGenerator = new RNGCryptoServiceProvider();
byte[] buffer = new byte[length];
cryptoRandomDataGenerator.GetBytes(buffer);
string uniq = Convert.ToBase64String(buffer);
return uniq;
Andrew Arnott
  • 80,040
  • 26
  • 132
  • 171
  • 1
    No. But the client secret doesn't have to be unique. Only the client id has to be. Also, given a sufficiently long `length` in the above code sample (say, 32+) it's statistically *very* improbable that two identical codes will be generated. – Andrew Arnott Jan 29 '12 at 00:08
  • What do you recommend for the secret? – davidbitton Oct 25 '12 at 15:17
  • 6
    @davidbitton I recommend the secret always be set to "supersecret" so that no one can guess it. ;-p – Andrew Arnott Oct 25 '12 at 16:15
  • Here is a version in PowerShell https://stackoverflow.com/a/47384324/75172 – Philippe Nov 20 '17 at 02:40
2

The specs are not clear about how you should generate them, but they say that you they should be random strings and unique.

In the section #2.2, about the client identifier:

The authorization server issues the registered client a client identifier - a unique string representing the registration information provided by the client.

Community
  • 1
  • 1
Felipe Elias Philipp
  • 584
  • 4
  • 6