Mercurial > prosody-modules

annotate mod_auth_oauth_external/README.md @ 6559:228859ea4781

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_muc_members_json: do not automatically unban entities This would otherwise serve to evade temporary bans.
author Jonas Schäfer <jonas@wielicki.name>
date Sat, 06 Jun 2026 08:40:31 +0200
parents 6f2f21b00233
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
5344
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
1 ---
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
2 summary: Authenticate against an external OAuth 2 IdP
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
3 labels:
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
4 - Stage-Alpha
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
5 ---
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
6
5861
c20a0c8a54ea mod_auth_oauth_external: Fix typo
Kim Alvefur <zash@zash.se>
parents: 5499
diff changeset
7 This module provides external authentication via an external [OAuth
5344
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
8 2](https://datatracker.ietf.org/doc/html/rfc7628) authorization server
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
9 and supports the [SASL OAUTHBEARER authentication][rfc7628]
5345
3390bb2f9f6c mod_auth_oauth_external: Support PLAIN via resource owner password grant
Kim Alvefur <zash@zash.se>
parents: 5344
diff changeset
10 mechanism as well as PLAIN for legacy clients (this is all of them).
5344
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
11
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
12 # How it works
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
13
6020
cce76628c83a mod_auth_oauth_external: Reword 'How it works'
Kim Alvefur <zash@zash.se>
parents: 5861
diff changeset
14 Using OAuth 2.0 in XMPP is explained in [XEP-0493: OAuth Client Login].
cce76628c83a mod_auth_oauth_external: Reword 'How it works'
Kim Alvefur <zash@zash.se>
parents: 5861
diff changeset
15 Clients pass tokens from the Authorization Server to Prosody, which
cce76628c83a mod_auth_oauth_external: Reword 'How it works'
Kim Alvefur <zash@zash.se>
parents: 5861
diff changeset
16 attempts to validate the tokens using the configured validation
cce76628c83a mod_auth_oauth_external: Reword 'How it works'
Kim Alvefur <zash@zash.se>
parents: 5861
diff changeset
17 endpoint.
5344
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
18
6020
cce76628c83a mod_auth_oauth_external: Reword 'How it works'
Kim Alvefur <zash@zash.se>
parents: 5861
diff changeset
19 Legacy clients have to use SASL PLAIN, where Prosody receives the users
cce76628c83a mod_auth_oauth_external: Reword 'How it works'
Kim Alvefur <zash@zash.se>
parents: 5861
diff changeset
20 username and password and attempts to validate this using the OAuth 2
cce76628c83a mod_auth_oauth_external: Reword 'How it works'
Kim Alvefur <zash@zash.se>
parents: 5861
diff changeset
21 resource owner password grant.
5345
3390bb2f9f6c mod_auth_oauth_external: Support PLAIN via resource owner password grant
Kim Alvefur <zash@zash.se>
parents: 5344
diff changeset
22
5344
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
23 # Configuration
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
24
5349
ac9710126e1a mod_auth_oauth_external: Add configuration example
Kim Alvefur <zash@zash.se>
parents: 5348
diff changeset
25 ## Example
ac9710126e1a mod_auth_oauth_external: Add configuration example
Kim Alvefur <zash@zash.se>
parents: 5348
diff changeset
26
6363
8f65b23a5fd2 mod_auth_oauth_external: Improve example
Kim Alvefur <zash@zash.se>
parents: 6020
diff changeset
27 ### KeyCloak example
5349
ac9710126e1a mod_auth_oauth_external: Add configuration example
Kim Alvefur <zash@zash.se>
parents: 5348
diff changeset
28
6363
8f65b23a5fd2 mod_auth_oauth_external: Improve example
Kim Alvefur <zash@zash.se>
parents: 6020
diff changeset
29 ```lua
8f65b23a5fd2 mod_auth_oauth_external: Improve example
Kim Alvefur <zash@zash.se>
parents: 6020
diff changeset
30 VirtualHost "example.net"
8f65b23a5fd2 mod_auth_oauth_external: Improve example
Kim Alvefur <zash@zash.se>
parents: 6020
diff changeset
31 authentication = "oauth_external"
8f65b23a5fd2 mod_auth_oauth_external: Improve example
Kim Alvefur <zash@zash.se>
parents: 6020
diff changeset
32
8f65b23a5fd2 mod_auth_oauth_external: Improve example
Kim Alvefur <zash@zash.se>
parents: 6020
diff changeset
33 -- KeyCloak URLs
8f65b23a5fd2 mod_auth_oauth_external: Improve example
Kim Alvefur <zash@zash.se>
parents: 6020
diff changeset
34 oauth_external_discovery_url = "https://auth.example.com/auth/realms/ExampleRealm/.well-known/openid-configuration"
8f65b23a5fd2 mod_auth_oauth_external: Improve example
Kim Alvefur <zash@zash.se>
parents: 6020
diff changeset
35 oauth_external_token_endpoint = "https://auth.example.com/auth/realms/ExampleRealm/protocol/openid-connect/token"
8f65b23a5fd2 mod_auth_oauth_external: Improve example
Kim Alvefur <zash@zash.se>
parents: 6020
diff changeset
36 oauth_external_validation_endpoint = "https://auth.example.com/auth/realms/ExampleRealm/protocol/openid-connect/userinfo"
5349
ac9710126e1a mod_auth_oauth_external: Add configuration example
Kim Alvefur <zash@zash.se>
parents: 5348
diff changeset
37 oauth_external_username_field = "xmpp_username"
ac9710126e1a mod_auth_oauth_external: Add configuration example
Kim Alvefur <zash@zash.se>
parents: 5348
diff changeset
38 ```
ac9710126e1a mod_auth_oauth_external: Add configuration example
Kim Alvefur <zash@zash.se>
parents: 5348
diff changeset
39
6367
d454eae0d8ef mod_auth_oauth_external: Add Mastodon example
Kim Alvefur <zash@zash.se>
parents: 6366
diff changeset
40 ### Mastodon Example
d454eae0d8ef mod_auth_oauth_external: Add Mastodon example
Kim Alvefur <zash@zash.se>
parents: 6366
diff changeset
41
d454eae0d8ef mod_auth_oauth_external: Add Mastodon example
Kim Alvefur <zash@zash.se>
parents: 6366
diff changeset
42 ```lua
d454eae0d8ef mod_auth_oauth_external: Add Mastodon example
Kim Alvefur <zash@zash.se>
parents: 6366
diff changeset
43 VirtualHost "example.net"
d454eae0d8ef mod_auth_oauth_external: Add Mastodon example
Kim Alvefur <zash@zash.se>
parents: 6366
diff changeset
44 authentication = "oauth_external"
d454eae0d8ef mod_auth_oauth_external: Add Mastodon example
Kim Alvefur <zash@zash.se>
parents: 6366
diff changeset
45
d454eae0d8ef mod_auth_oauth_external: Add Mastodon example
Kim Alvefur <zash@zash.se>
parents: 6366
diff changeset
46 oauth_external_token_endpoint = "https://mastodon.example/oauth/token"
d454eae0d8ef mod_auth_oauth_external: Add Mastodon example
Kim Alvefur <zash@zash.se>
parents: 6366
diff changeset
47 oauth_external_validation_endpoint = "https://mastodon.example/api/v1/accounts/verify_credentials"
d454eae0d8ef mod_auth_oauth_external: Add Mastodon example
Kim Alvefur <zash@zash.se>
parents: 6366
diff changeset
48 oauth_external_username_field = "username"
d454eae0d8ef mod_auth_oauth_external: Add Mastodon example
Kim Alvefur <zash@zash.se>
parents: 6366
diff changeset
49 oauth_external_scope = "read:accounts"
d454eae0d8ef mod_auth_oauth_external: Add Mastodon example
Kim Alvefur <zash@zash.se>
parents: 6366
diff changeset
50 oauth_external_resource_owner_password = true
d454eae0d8ef mod_auth_oauth_external: Add Mastodon example
Kim Alvefur <zash@zash.se>
parents: 6366
diff changeset
51 ```
d454eae0d8ef mod_auth_oauth_external: Add Mastodon example
Kim Alvefur <zash@zash.se>
parents: 6366
diff changeset
52
6527
6f2f21b00233 mod_auth_oauth_external: Expand descriptions of settings
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
53 ## Settings
5349
ac9710126e1a mod_auth_oauth_external: Add configuration example
Kim Alvefur <zash@zash.se>
parents: 5348
diff changeset
54
5346
d9bc8712a745 mod_auth_oauth_external: Allow setting identity instead of discovery URL
Kim Alvefur <zash@zash.se>
parents: 5345
diff changeset
55 `oauth_external_issuer`
d9bc8712a745 mod_auth_oauth_external: Allow setting identity instead of discovery URL
Kim Alvefur <zash@zash.se>
parents: 5345
diff changeset
56 : Optional URL string representing the Authorization server identity.
d9bc8712a745 mod_auth_oauth_external: Allow setting identity instead of discovery URL
Kim Alvefur <zash@zash.se>
parents: 5345
diff changeset
57
5344
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
58 `oauth_external_discovery_url`
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
59 : Optional URL string pointing to [OAuth 2.0 Authorization Server
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
60 Metadata](https://oauth.net/2/authorization-server-metadata/). Lets
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
61 clients discover where they should retrieve access tokens from if
6527
6f2f21b00233 mod_auth_oauth_external: Expand descriptions of settings
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
62 they don't have one yet. Defaults to
6f2f21b00233 mod_auth_oauth_external: Expand descriptions of settings
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
63 `issuer_identity + "/.well-known/oauth-authorization-server"` when
6f2f21b00233 mod_auth_oauth_external: Expand descriptions of settings
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
64 `oauth_external_issuer` is set, otherwise unset.
5344
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
65
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
66 `oauth_external_validation_endpoint`
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
67 : URL string. The token validation endpoint, should validate the token
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
68 and return a JSON structure containing the username of the user
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
69 logging in the field specified by `oauth_external_username_field`.
6527
6f2f21b00233 mod_auth_oauth_external: Expand descriptions of settings
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
70 Required for SASL OAUTHBEARER. For SASL PLAIN, enables username
6f2f21b00233 mod_auth_oauth_external: Expand descriptions of settings
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
71 lookup. Commonly the [OpenID `UserInfo`
5344
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
72 endpoint](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo)
5434
92ad8f03f225 mod_auth_oauth_external: Work without token validation endpoint
Kim Alvefur <zash@zash.se>
parents: 5349
diff changeset
73 If left unset, only `SASL PLAIN` is supported and the username
92ad8f03f225 mod_auth_oauth_external: Work without token validation endpoint
Kim Alvefur <zash@zash.se>
parents: 5349
diff changeset
74 provided there is assumed correct.
5344
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
75
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
76 `oauth_external_username_field`
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
77 : String. Default is `"preferred_username"`. Field in the JSON
6527
6f2f21b00233 mod_auth_oauth_external: Expand descriptions of settings
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
78 structure returned by the validation endpoint that to be used as the
6f2f21b00233 mod_auth_oauth_external: Expand descriptions of settings
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
79 XMPP localpart.
5345
3390bb2f9f6c mod_auth_oauth_external: Support PLAIN via resource owner password grant
Kim Alvefur <zash@zash.se>
parents: 5344
diff changeset
80
3390bb2f9f6c mod_auth_oauth_external: Support PLAIN via resource owner password grant
Kim Alvefur <zash@zash.se>
parents: 5344
diff changeset
81 `oauth_external_resource_owner_password`
6527
6f2f21b00233 mod_auth_oauth_external: Expand descriptions of settings
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
82 : Boolean. Defaults to `true`. Enables SASL PLAIN for legacy XMPP
6f2f21b00233 mod_auth_oauth_external: Expand descriptions of settings
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
83 clients via the [resource owner password
6f2f21b00233 mod_auth_oauth_external: Expand descriptions of settings
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
84 grant](https://oauth.net/2/grant-types/password/) *(considered
6f2f21b00233 mod_auth_oauth_external: Expand descriptions of settings
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
85 insecure)*.
5345
3390bb2f9f6c mod_auth_oauth_external: Support PLAIN via resource owner password grant
Kim Alvefur <zash@zash.se>
parents: 5344
diff changeset
86
3390bb2f9f6c mod_auth_oauth_external: Support PLAIN via resource owner password grant
Kim Alvefur <zash@zash.se>
parents: 5344
diff changeset
87 `oauth_external_token_endpoint`
3390bb2f9f6c mod_auth_oauth_external: Support PLAIN via resource owner password grant
Kim Alvefur <zash@zash.se>
parents: 5344
diff changeset
88 : URL string. OAuth 2 [Token
3390bb2f9f6c mod_auth_oauth_external: Support PLAIN via resource owner password grant
Kim Alvefur <zash@zash.se>
parents: 5344
diff changeset
89 Endpoint](https://www.rfc-editor.org/rfc/rfc6749#section-3.2) used
6527
6f2f21b00233 mod_auth_oauth_external: Expand descriptions of settings
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
90 to validate credentials passed via SASL PLAIN.
5345
3390bb2f9f6c mod_auth_oauth_external: Support PLAIN via resource owner password grant
Kim Alvefur <zash@zash.se>
parents: 5344
diff changeset
91
3390bb2f9f6c mod_auth_oauth_external: Support PLAIN via resource owner password grant
Kim Alvefur <zash@zash.se>
parents: 5344
diff changeset
92 `oauth_external_client_id`
6527
6f2f21b00233 mod_auth_oauth_external: Expand descriptions of settings
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
93 : String. Client ID used to identify Prosody in the resource owner
5345
3390bb2f9f6c mod_auth_oauth_external: Support PLAIN via resource owner password grant
Kim Alvefur <zash@zash.se>
parents: 5344
diff changeset
94 password grant.
3390bb2f9f6c mod_auth_oauth_external: Support PLAIN via resource owner password grant
Kim Alvefur <zash@zash.se>
parents: 5344
diff changeset
95
5435
b3e7886fea6a mod_auth_oauth_external: Add setting for client_secret
Kim Alvefur <zash@zash.se>
parents: 5434
diff changeset
96 `oauth_external_client_secret`
6527
6f2f21b00233 mod_auth_oauth_external: Expand descriptions of settings
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
97 : String. Client secret used to identify Prosody in the resource owner
6f2f21b00233 mod_auth_oauth_external: Expand descriptions of settings
Kim Alvefur <zash@zash.se>
parents: 6367
diff changeset
98 password grant.
5435
b3e7886fea6a mod_auth_oauth_external: Add setting for client_secret
Kim Alvefur <zash@zash.se>
parents: 5434
diff changeset
99
5436
e7d99bacd0e8 mod_auth_oauth_external: Make 'scope' configurable in password grant request
Kim Alvefur <zash@zash.se>
parents: 5435
diff changeset
100 `oauth_external_scope`
5499
27d220b14d59 mod_auth_oauth_external: Correct docs about default scope
Kim Alvefur <zash@zash.se>
parents: 5444
diff changeset
101 : String. Defaults to `"openid"`. Included in request for resource
5436
e7d99bacd0e8 mod_auth_oauth_external: Make 'scope' configurable in password grant request
Kim Alvefur <zash@zash.se>
parents: 5435
diff changeset
102 owner password grant.
e7d99bacd0e8 mod_auth_oauth_external: Make 'scope' configurable in password grant request
Kim Alvefur <zash@zash.se>
parents: 5435
diff changeset
103
5344
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
104 # Compatibility
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
105
5347
a0074038696f mod_auth_oauth_external: Some notes in README
Kim Alvefur <zash@zash.se>
parents: 5346
diff changeset
106 ## Prosody
a0074038696f mod_auth_oauth_external: Some notes in README
Kim Alvefur <zash@zash.se>
parents: 5346
diff changeset
107
5344
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
108 Version Status
5444
0c7abc81c243 mod_auth_oauth_external: Update compatibility section with unknowns
Kim Alvefur <zash@zash.se>
parents: 5441
diff changeset
109 --------- -----------------------------------------------
5344
0a6d2b79a8bf mod_auth_oauth_external: Authenticate against an OAuth 2 provider
Kim Alvefur <zash@zash.se>
parents:
diff changeset
110 trunk works
6366
866401d78e7d mod_auth_oauth_external: Update Compatibility section with 13.0.x
Kim Alvefur <zash@zash.se>
parents: 6363
diff changeset
111 13.0.x works
5444
0c7abc81c243 mod_auth_oauth_external: Update compatibility section with unknowns
Kim Alvefur <zash@zash.se>
parents: 5441
diff changeset
112 0.12.x OAUTHBEARER will not work, otherwise untested
0c7abc81c243 mod_auth_oauth_external: Update compatibility section with unknowns
Kim Alvefur <zash@zash.se>
parents: 5441
diff changeset
113 0.11.x OAUTHBEARER will not work, otherwise untested
5347
a0074038696f mod_auth_oauth_external: Some notes in README
Kim Alvefur <zash@zash.se>
parents: 5346
diff changeset
114
a0074038696f mod_auth_oauth_external: Some notes in README
Kim Alvefur <zash@zash.se>
parents: 5346
diff changeset
115 ## Identity Provider
a0074038696f mod_auth_oauth_external: Some notes in README
Kim Alvefur <zash@zash.se>
parents: 5346
diff changeset
116
a0074038696f mod_auth_oauth_external: Some notes in README
Kim Alvefur <zash@zash.se>
parents: 5346
diff changeset
117 Tested with
a0074038696f mod_auth_oauth_external: Some notes in README
Kim Alvefur <zash@zash.se>
parents: 5346
diff changeset
118
a0074038696f mod_auth_oauth_external: Some notes in README
Kim Alvefur <zash@zash.se>
parents: 5346
diff changeset
119 - [KeyCloak](https://www.keycloak.org/)
5441
533808db6c18 mod_auth_oauth_external: Add Mastodon to README
Kim Alvefur <zash@zash.se>
parents: 5436
diff changeset
120 - [Mastodon](https://joinmastodon.org/)
5347
a0074038696f mod_auth_oauth_external: Some notes in README
Kim Alvefur <zash@zash.se>
parents: 5346
diff changeset
121
a0074038696f mod_auth_oauth_external: Some notes in README
Kim Alvefur <zash@zash.se>
parents: 5346
diff changeset
122 # Future work
a0074038696f mod_auth_oauth_external: Some notes in README
Kim Alvefur <zash@zash.se>
parents: 5346
diff changeset
123
a0074038696f mod_auth_oauth_external: Some notes in README
Kim Alvefur <zash@zash.se>
parents: 5346
diff changeset
124 - Automatically discover endpoints from Discovery URL
a0074038696f mod_auth_oauth_external: Some notes in README
Kim Alvefur <zash@zash.se>
parents: 5346
diff changeset
125 - Configurable input username mapping (e.g. user → user@host).
a0074038696f mod_auth_oauth_external: Some notes in README
Kim Alvefur <zash@zash.se>
parents: 5346
diff changeset
126 - [SCRAM over HTTP?!][rfc7804]