Protocol practice· Authentication & Credentials Members
Device code: sign in on a device with no keyboard worth typing on
Objective: Lumen Notes ships a command-line tool, lumen, that people run on servers and in terminals with no browser. Let them sign in with their phone instead, keep the tool polling politely, and make sure a phished code doesn’t hand an attacker the account.
5 steps12 concepts 10 min
Where the device code flow fitsNot sure? Which protocol?
Who is this? · 5 labs
- OpenID Connect
- SAML
- Kerberos
- Device codeYou are here
- Shared Signals
What you’ll do
- 1Ask the authorization server for a pair of codes. Someone types lumen login in a terminal.
- 2Tell the person where to go. The terminal can print text, and many terminals can render a QR code.
- 3Wait for the person, without hammering the server. While the person picks up their phone, the tool asks the token endpoint whether they’ve finished.
- 4Make the approval page say what’s happening. Maya opens the address on her phone, enters WDJB-MJHT, and signs in with her passkey.
- 5A code arrives by email. Maya gets an email: “Your notes will be archived.