That's a good point :) We may want to allow batch exchanges for an upgrade flow, but you're right, then that doesn't really apply here.
On Jun 29, 2010, at 6:50 PM, Marius Scurtescu wrote: > On Tue, Jun 29, 2010 at 6:30 PM, Luke Shepard <[email protected]> wrote: >> One reason is that you may want to exchange tokens in a batch, whereas you >> typically can only sign requests individually. > > How does the assertion grant type help in this case? As far as I can > tell this also allows you to exchange only one token. > > Marius > > >> >> On Jun 29, 2010, at 6:12 PM, Marius Scurtescu wrote: >> >>> On Tue, Jun 29, 2010 at 8:22 AM, Eran Hammer-Lahav <[email protected]> >>> wrote: >>>> >>>> The assertion grant type is really the grant type extension point. >>>> Libraries should treat it as a way to support custom grant types. One of >>>> the things I would like to see someone draft is how to use OAuth 1.0 >>>> tokens to obtain OAuth 2.0 tokens using the assertion type. For example, >>>> the assertion type can be "http://oauth.net/1.0/token"; , and the assertion >>>> itself is some form of the token and signature (or secrets) concatenated >>>> into a string (this will maintain the 1.0 security while transitioning to >>>> 2.0). This is just a straw man. >>>> >>>> It is important that libraries support this extensibility with some form >>>> of a hook or handler so that clients can make requests using assertions >>>> from outside the library. >>> >>> An OAuth 1 token assertion as described above would achieve the same >>> thing as the suggested bridge endpoint. Do you see any advantages on >>> using an assertion as opposed to a standard OAuth 1 signed request? >>> >>> Marius >>> _______________________________________________ >>> OAuth mailing list >>> [email protected] >>> https://www.ietf.org/mailman/listinfo/oauth >> >> _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
