[OAUTH-WG] OAuth 1.0 token assertion to OAuth 2.0 token (was: Draft -09)

[Marius Scurtescu <[e-mail]>]

On Tue, Jun 29, 2010 at 8:22 AM, Eran Hammer-Lahav <[e-mail]> wrote:
>
> The assertion grant type is really the grant type extension point. Libraries should treat it as a way to support custom grant types. One of the things I would like to see someone draft is how to use OAuth 1.0 tokens to obtain OAuth 2.0 tokens using the assertion type. For example, the assertion type can be "http://oauth.net/1.0/token" , and the assertion itself is some form of the token and signature (or secrets) concatenated into a string (this will maintain the 1.0 security while transitioning to 2.0). This is just a straw man.
>
> It is important that libraries support this extensibility with some form of a hook or handler so that clients can make requests using assertions from outside the library.

An OAuth 1 token assertion as described above would achieve the same
thing as the suggested bridge endpoint. Do you see any advantages on
using an assertion as opposed to a standard OAuth 1 signed request?

Marius