Re: [oauth] FW: I-D Action:draft-dehora-farrell-oauth-accesstoken-creds-01.txt

Basic or Digest would, I think, represent the consumer
authenticating as itself and could in fact be mixed with
the consumer passing on the user's credentials in order
to get an access token. (That was explicitly called out
in -00 but removed here since we bumped the security
level somewhat. Could add it back though.)

So, at least for the aggregator use case, I think these
are a) semantically different and b) might even be used
at the same time and so shouldn't be mixed.

I could imagine however an option for a user agent to
use Basic or Digest in an exchange that'd result in
acquisition of an access token. (Which is I guess what
your blog post below is about.) But since that'd require
a change to the browser to be generally useful we didn't
go there. I'd have to think about whether that'd work
for mobile use cases, but I suspect that the requirement
for two round-trips'd work against it there.

S.

Eran Hammer-Lahav wrote:
> Here's a silly question, why not just use HTTP Basic or Digest auth to accomplish the same thing? Ask for a token using the actual resource owner's server credentials (username and password) and, well, get one.
> 
> Am I missing something?
> 
> More ideas in http://www.hueniverse.com/hueniverse/2009/02/beyond-the-oauth-web-redirection-flow.html
> 
> EHL
> 
> -----Original Message-----
> From: i-d-announce-bounces@ietf.org [mailto:i-d-announce-bounces@ietf.org] On Behalf Of Internet-Drafts@ietf.org
> Sent: Monday, March 09, 2009 12:00 PM
> To: i-d-announce@ietf.org
> Subject: I-D Action:draft-dehora-farrell-oauth-accesstoken-creds-01.txt 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> 
> 	Title           : OAuth Access Tokens using credentials
> 	Author(s)       : B. hOra, S. Farrell
> 	Filename        : draft-dehora-farrell-oauth-accesstoken-creds-01.txt
> 	Pages           : 13
> 	Date            : 2009-03-09
> 
> OAuth Access Tokens using credentials is a technique for allowing user agents to obtain an OAuth access token on behalf of a user without requiring user intervention or HTTP redirection to a browser.
> OAuth itself is documented in the OAuth Core 1.0 Specification.Editorial Note
> 
> To provide feedback on this Internet-Draft, email the authors.
> 
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-dehora-farrell-oauth-accesstoken-creds-01.txt
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft.
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> oauth mailing list
> oauth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth