Re: [GNAP] [Txauth] Revisiting the photo sharing example (a driving use case for the creation of OAuth)

[Denis <[e-mail]>]

  Justin,

Your response does not address my point. I am talking of two different 
channels with the RS, i.e. not with the AS.

Denis

> Denis, I want to focus on one point here:
>
>> In OAuth 2.0, the user consent is performed by the AS using an 
>> authorize endpoint where the user consent is solicited and captured.
>>
>> Since a user, with no prior experience, shall first connect to a RS 
>> to perform an operation, the user consent shall be performed by the RS,
>> instead of the AS. This means that we should define a "consent" 
>> endpoint at the RS.
>
> One of my goals with XYZ’s design was to be able to separate the 
> interaction with the user from the web-based flows for the delegation 
> protocol, and that aspect is enshrined in the GNAP charter as well.
>
> It points to the reality that there are two different aspects of the 
> traditional AS that we might need to talk about separately now. One 
> deals with delegation, issuing tokens, returning data directly to the 
> client (not through a separate API, since that’s the RS), and other 
> back-channel stuff. The other aspect deals with interacting with the 
> user and/or resource owner.
>
> We already saw bits of this in OAuth 2: the AS is defined by the pair 
> of the token endpoint and authorization endpoint, each filling the 
> respective roles above. What if we formally separate these? Strawman 
> names:
>
> Delegation Server (DS) - handles the back-channel stuff
>
> Interaction Server (IS) - handles the front-channel stuff
>
>
>  — Justin
>