If a client wants to authenticate itself to a token endpoint to get an access
token using an assertion how should it do it?
Grant_Type = assertion doesn't seem right because that assertion should be from
the resource owner who delegated the permission, not from the client, right? In
other words one can end up with an access token request with two assertions,
one from the client and one from the resource owner. How is this done?
Thanks,
Yaron
P.S. I looked for something like client_assertion and client_assertion_type in
section 2 of -08 but didn't see it. Sorry if I missed it.
_______________________________________________
OAuth mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/oauth
