Subject: [OAUTH-WG] Draft 9, Section 2 vs. Section 4.1

From: Andrew Arnott <[email-masked]>
Date: Sat, 3 Jul 2010 17:42:28 -0700

It may be my misreading the spec, or making assumptions based on my
cluttered mind from reading the various drafts, so apologies if I'm just
confused, but...

Section 2 seems to be just sitting there.  No discussion on how it fits into
the spec from what I can see.  It doesn't discuss how to obtain a grant, or
access token, or anything.  It also mentions type=web-server, which is an
obsolete parameter.

Section 4.1 has a grant_type=none option, which seems to cover the same
scenario as Section 2 (did).  I take it that section 4.1 is sort of the "2
legged OAuth" scenario.  Am I correct in this?

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death
your right to say it." - S. G. Tallentyre

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Sat, 3 Jul 2010 21:51:17 -0700

Section 2 talked about how the client authenticates itself. This is used in the token endpoint but can be used elsewhere (i.e. A device profile).

EHL

On 7/3/10 5:42 PM, "Andrew Arnott" <[email-masked]> wrote:

It may be my misreading the spec, or making assumptions based on my cluttered mind from reading the various drafts, so apologies if I'm just confused, but...

Section 2 seems to be just sitting there.  No discussion on how it fits into the spec from what I can see.  It doesn't discuss how to obtain a grant, or access token, or anything.  It also mentions type=web-server, which is an obsolete parameter.

Section 4.1 has a grant_type=none option, which seems to cover the same scenario as Section 2 (did).  I take it that section 4.1 is sort of the "2 legged OAuth" scenario.  Am I correct in this?

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre