Re: [OAUTH-WG] RSA signing and web delegation

[Eran Hammer-Lahav <eran at hueniverse.com>]

The "Basic auth alternative" would be a single request flow with shared secret (either symmetric or asymmetric). I am not sure how the flow below applies (when compared to Basic auth).

EHL

> -----Original Message-----
> From: Brian Eaton [mailto:beaton at google.com]
> Sent: Friday, November 06, 2009 9:23 AM
> To: Eran Hammer-Lahav
> Cc: John Panzer; oauth at ietf.org
> Subject: Re: [OAUTH-WG] RSA signing and web delegation
> 
> On Thu, Nov 5, 2009 at 10:33 PM, Eran Hammer-Lahav
> <eran at hueniverse.com> wrote:
> > Do you need an RSA option for the "Basic Auth Alternative" case?
> 
> Yes.  I've been thinking of it as "role account authentication with
> OAuth", because that's the main place I see it being really useful.
> 
> Here's how I would model it:
> 
> - send an RSA-signed message to an authorization server
> - authorization server returns an access token (and possibly a secret)
> to the client
> - client uses the access token for data access
> 
> Cheers,
> Brian