Return-Path: X-Original-To: oauth@core3.amsl.com Delivered-To: oauth@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 858263A6918 for ; Mon, 27 Sep 2010 21:42:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.492 X-Spam-Level: X-Spam-Status: No, score=-2.492 tagged_above=-999 required=5 tests=[AWL=0.106, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id meSKEwXp4kRb for ; Mon, 27 Sep 2010 21:42:09 -0700 (PDT) Received: from p3plex1out01.prod.phx3.secureserver.net (p3plex1out01.prod.phx3.secureserver.net [72.167.180.17]) by core3.amsl.com (Postfix) with SMTP id CF9DE3A6C30 for ; Mon, 27 Sep 2010 21:42:08 -0700 (PDT) Received: (qmail 824 invoked from network); 28 Sep 2010 04:42:47 -0000 Received: from unknown (HELO smtp.ex1.secureserver.net) (72.167.180.21) by p3plex1out01.prod.phx3.secureserver.net with SMTP; 28 Sep 2010 04:42:47 -0000 Received: from P3PW5EX1MB01.EX1.SECURESERVER.NET ([10.6.135.20]) by P3PW5EX1HT003.EX1.SECURESERVER.NET ([72.167.180.21]) with mapi; Mon, 27 Sep 2010 21:42:48 -0700 From: Eran Hammer-Lahav To: Lukas Rosenstock Date: Mon, 27 Sep 2010 21:42:52 -0700 Thread-Topic: [OAUTH-WG] Document Management Issue (Signatures) Thread-Index: ActejPaEa2GxTh9KSfmVuA3qtdceCgAOoVbA Message-ID: <90C41DD21FB7C64BB94121FBBC2E72343D460DB5B3@P3PW5EX1MB01.EX1.SECURESERVER.NET> References: <3D3C75174CB95F42AD6BCC56E5555B45031BA596@FIESEXC015.nsn-intra.net> <90C41DD21FB7C64BB94121FBBC2E72343D460DB374@P3PW5EX1MB01.EX1.SECURESERVER.NET> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/alternative; boundary="_000_90C41DD21FB7C64BB94121FBBC2E72343D460DB5B3P3PW5EX1MB01E_" MIME-Version: 1.0 Cc: "oauth@ietf.org" Subject: Re: [OAUTH-WG] Document Management Issue (Signatures) X-BeenThere: oauth@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: OAUTH WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Sep 2010 04:42:13 -0000 --_000_90C41DD21FB7C64BB94121FBBC2E72343D460DB5B3P3PW5EX1MB01E_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Maybe, but that's something we actually have wide consensus that is not nee= ded. The current draft replaces signatures for obtaining an access token us= ing other means. EHL From: Lukas Rosenstock [mailto:lr@lukasrosenstock.net] Sent: Monday, September 27, 2010 2:43 PM To: Eran Hammer-Lahav Cc: oauth@ietf.org Subject: Re: [OAUTH-WG] Document Management Issue (Signatures) 2010/9/27 Eran Hammer-Lahav > I would also be happy with the core only dealing with *getting* a token, an= d moving all text about *using* a token to other documents. This will produ= ce three parts: 1. Getting a document 2. Using bearer tokens 3. Using cryptographic tokens Won't there be any scenarios in which signatures are required for getting a= token, like in OAuth 1 (the request is signed with the client id/secret)? --_000_90C41DD21FB7C64BB94121FBBC2E72343D460DB5B3P3PW5EX1MB01E_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Maybe, bu= t that’s something we actually have wide consensus that is not needed= . The current draft replaces signatures for obtaining an access token using= other means.

 <= /o:p>

EHL

 

From: Lukas Rosenstock [mailto:lr@lukasrosenstock.net]
<= b>Sent: Monday, September 27, 2010 2:43 PM
To: Eran Hammer-La= hav
Cc: oauth@ietf.org
Subject: Re: [OAUTH-WG] Document= Management Issue (Signatures)

 

 

2010/9/27 Eran Hammer-Lahav <eran@hueniverse.com>

I would also be happy wi= th the core only dealing with *getting* a token, and moving all text= about *using* a token to other documents. This will produce three p= arts:

 

1.  = ;     Getting a document

2.=        Using bearer tokens

3.       Using cryptographic tokens

 

Won't there be any scenarios in which signatures are requi= red for getting a token, like in OAuth 1 (the request is signed with the cl= ient id/secret)?

 <= /o:p>

= --_000_90C41DD21FB7C64BB94121FBBC2E72343D460DB5B3P3PW5EX1MB01E_--