Re: [OAUTH-WG] Separate names for authentication and authorization

The high-level separation makes sense; I'm fine with reserving OAuth  
for the delegation flow and calling the authentication method  
something else.  (Digression: Could this be helpful in allowing other  
authentication mechanisms into OAuth?)

That said, I'm not sure "Token Auth" is quite accurate (you could just  
as well pass a token over Basic).  The important thing about the  
authentication scheme that OAuth defines is that it provides some of  
the benefit of Digest (e.g., it doesn't reveal secrets) but without  
requiring two RTTs.  Maybe something like "Direct Auth" ("One-Shot"?  
"Simple-Digest"?).

On the other hand, it is just a name.  That which we call OAuth, by  
any other name..

--Richard

On Nov 24, 2009, at 12:45 AM, Eran Hammer-Lahav wrote:

> How do people feel about using OAuth as the name for the different  
> flows to obtain a token, including the new flows defined in WRAP,  
> and calling the authentication part simply the Token Authentication  
> scheme, in line with Basic and Digest?
>
> I think this would be much more in-line with people's expectations  
> of the OAuth "brand".
>
> EHL
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth