Re: [OAUTH-WG] OAuth Signature Draft Pre 00

2010-09-21 Thread hdknr hidelafoglia
Sorry, I was wrong. "If Claim segment " is right. 2010/9/22 hdknr hidelafoglia : > Hi, > > If Crypto segment has a switch parameters of encryption or signature, > JSON Token seems to  handle encrypted token as well as signed token. > > --- > hdknr > > > 2010/8/31 Yaron Goland : >> BTW, Nat and

Re: [OAUTH-WG] Simpilfying use of assertions when requesting an access token

2010-09-21 Thread Brian Campbell
I'm not sure one email from me asking for clarification exactly counts as a movement ;-) I was just thinking that it'd be more consistent to have each uri-defined grant type define it's own parameter set. Really this is what is already happening with the core defined short names - the "authorizat

Re: [OAUTH-WG] Simpilfying use of assertions when requesting an access token

2010-09-21 Thread Justin Richer
I personally think it makes a certain amount of sense to have the assertion parameter: if you have only one thing to say, here's where to say it. And I think that we've got a few cases of assertions with only a single string to assert. However, I was always concerned with that single parameter as t

Re: [OAUTH-WG] Simpilfying use of assertions when requesting an access token

2010-09-21 Thread Brian Campbell
Following from that (Justin: "url-defined grant type can also legally add and remove parameters from the endpoint, right?" / Eran: "Yes") does the assertion parameter still make sense to have in the core spec? I had sort of assumed that it would be going away in favor of whatever parameters any ur

Re: [OAUTH-WG] OAuth Signature Draft Pre 00

2010-09-21 Thread Anthony Nadalin
Might actually want both @ same time, so might be better to expand -Original Message- From: oauth-boun...@ietf.org [mailto:oauth-boun...@ietf.org] On Behalf Of hdknr hidelafoglia Sent: Tuesday, September 21, 2010 12:39 PM To: Yaron Goland Cc: oauth Subject: Re: [OAUTH-WG] OAuth Signature

Re: [OAUTH-WG] OAuth Signature Draft Pre 00

2010-09-21 Thread hdknr hidelafoglia
Hi, If Crypto segment has a switch parameters of encryption or signature, JSON Token seems to handle encrypted token as well as signed token. --- hdknr 2010/8/31 Yaron Goland : > BTW, Nat and I, as mentioned below, are talking. Here is my current draft. > Please keep in mind that it's really j

Re: [OAUTH-WG] User-Agent flow and refresh tokens

2010-09-21 Thread Torsten Lodderstedt
Am 20.09.2010 07:34, schrieb Luke Shepard: Yes, Facebook is recommending the User-Agent flow for desktop > applications. This works for them because access tokens issued by > Facebook are not short lived, I don't think they expire. The desktop > app does not need a refresh token. > > If th