Re: [OAUTH-WG] OAuth 1.0 token assertion to OAuth 2.0 token (was: Draft -09)

On Tue, Jun 29, 2010 at 6:30 PM, Luke Shepard <lshepard@facebook.com> wrote:
> One reason is that you may want to exchange tokens in a batch, whereas you typically can only sign requests individually.

How does the assertion grant type help in this case? As far as I can
tell this also allows you to exchange only one token.

Marius

>
> On Jun 29, 2010, at 6:12 PM, Marius Scurtescu wrote:
>
>> On Tue, Jun 29, 2010 at 8:22 AM, Eran Hammer-Lahav <eran@hueniverse.com> wrote:
>>>
>>> The assertion grant type is really the grant type extension point. Libraries should treat it as a way to support custom grant types. One of the things I would like to see someone draft is how to use OAuth 1.0 tokens to obtain OAuth 2.0 tokens using the assertion type. For example, the assertion type can be "http://oauth.net/1.0/token" , and the assertion itself is some form of the token and signature (or secrets) concatenated into a string (this will maintain the 1.0 security while transitioning to 2.0). This is just a straw man.
>>>
>>> It is important that libraries support this extensibility with some form of a hook or handler so that clients can make requests using assertions from outside the library.
>>
>> An OAuth 1 token assertion as described above would achieve the same
>> thing as the suggested bridge endpoint. Do you see any advantages on
>> using an assertion as opposed to a standard OAuth 1 signed request?
>>
>> Marius
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
>
>