Re: [OAUTH-WG] keeping support for RSA (Was: RE: OAuth 2.0 / Charter)

[Eran Hammer-Lahav <[e-mail]>]

I think what most people miss about this is that addition of a new method to obtain a *token* without a third party (resource owner, etc.) present. So instead of the current way OAuth is used for 2-legged, as a dumb substitution for Basic auth, this new approach works the same way across the two use cases (2, 3-legged), by always requiring the exchange of credentials for a token, even for 2-legged.

And as stated above, this will require some other means to obtain a token without the use of browser redirection and user authorization.

EHL

> -----Original Message-----
> From: Brian Eaton [mailto:[e-mail]]
> Sent: Monday, November 30, 2009 1:53 PM
> To: Eran Hammer-Lahav
> Cc: Moore, Jonathan (CIM); Paul C. Bryan; [e-mail]
> Subject: Re: [OAUTH-WG] keeping support for RSA (Was: RE: OAuth 2.0 /
> Charter)
> 
> On Mon, Nov 30, 2009 at 11:25 AM, Eran Hammer-Lahav
> <[e-mail]> wrote:
> >
> > 4. We are still very likely to have a PK-based method for obtaining
> > *authorization* (a token). So PK will be still available for obtaining
> > a token. I know this does not address the 2-legged scenario, but
> > whatever we come up there should be the same with whatever we may
> end up including in the authentication part.
> 
> This does actually address the two-legged scenario quite nicely.
> 
> Client sends PK-signed message to Authorization Server.
> Authorization Server returns token.
> Client uses token.
> 
> Cheers,
> Brian