Re: [OAUTH-WG] 2 Leg with OAuth 2.0

[Brian Hawkins <[e-mail]>]

Maybe I'm making this harder then it should be.

Here is the situation:  Site A and B both trust each other.  Site A needs
to update user information at site B.

With OAuth 1.0 Site A would use it's consumer key and secret to sign the
update call to Site B (no access token involved).  Only one message is sent.

The closest I can come to the above with OAuth 2.0 is to use the MAC token
scheme and sign the request with the consumer secret.  Is that valid?  I
kind of get the idea that the protocol doesn't care.

It feels like the bearer scheme just doesn't work for what I'm trying to do.

Thanks

Brian

On Tue, Nov 29, 2011 at 1:06 PM, Eran Hammer-Lahav <[e-mail]>wrote:

> This functionality can be implemented in two main ways:****
>
> ** **
>
> **1.       **Using the client credentials flow to get an access token,
> then using the protocol as usual****
>
> **2.       **Just using the Bearer (over SSL) or MAC token schemes
> without the rest of OAuth****
>
> ** **
>
> EHL****
>
> ** **
>
> *From:* [e-mail] [mailto:[e-mail]] *On Behalf
> Of *Brian Hawkins
> *Sent:* Tuesday, November 29, 2011 11:49 AM
> *To:* [e-mail]
> *Subject:* [OAUTH-WG] 2 Leg with OAuth 2.0****
>
> ** **
>
> I'm having trouble finding information on how to do 2leg authentication
> with OAuth 2.0.  Does it even support it?****
>
> ** **
>
> Thanks****
>
> Brian****
>