Subject: [OAUTH-WG] First WG drafts

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 6 Jul 2009 12:52:18 -0700

(Please note that the current version is -01 for both drafts. It is important to use the latest version due to change in section numbers.)

The OAuth Protocol: Authentication
http://www.ietf.org/internet-drafts/draft-ietf-oauth-authentication-01.txt

Describes the signature methods and making authenticated requests with two sets of credentials.

The OAuth Protocol: Web Delegation
http://www.ietf.org/internet-drafts/draft-ietf-oauth-web-delegation-01.txt

Describes how to obtain a set of token credentials by redirecting the resource owner over to the server to obtain authorization.

The old draft-hammer-oauth is now obsolete and will not be updated. Please submit feedback and issues and reference the relevant sections in these two drafts. 

The only significant changes in these two drafts from draft-hammer-oauth are:

* Break the specification into two parts, one dealing with making authenticated requests (previously section 3) and one dealing with obtaining authorization via web redirection (previously section 4).

* Apply the protocol changes from OAuth Core 1.0 Revision A to bring the web delegation draft (authentication was no affected) to the same place the OAuth Core 1.0 protocol is now. This was done to fix a session fixation attack found earlier this year.

EHL