Subject: [OAUTH-WG] RFC5849 - Purpose of Temporary Credentials Shared Secret?

From: "Craig Heath" <[email-masked]>
Date: Wed, 2 Mar 2011 10:05:15 -0800

Hello!  Can some kind soul help me understand the purpose of the shared secret part of the Temporary Credentials in RFC5849?

- The client authenticates using the Cient Credentials, and gets the Temporary Credentials.
- The Resource Owner gives their authorization.
- The Temporary Credentials are then used in the Token Credentials Request.

The part that's puzzling me is the RFC says the client authenticates using *both* the Client Credentials and the Token Credentials in the Token Credentials Request.  I could understand one or the other, but why both? (and incidentally, how can it provide both?)  Clearly the Token Credentials identifier is needed, as it is part of the Token Credentials Request; it's only the shared secret I'm wondering about (the "oauth_token_secret" part of the reponse to the Temporary Credentials Request).

My best guess so far is that it is intended to allow for the case when the Client Credentials are not secret, but in that case why use the Client Credentials at all in the Token Credential Request?

Thanks for any light shed on this!

- Craig Heath.

---

From: "Craig Heath" <[email-masked]>
Date: Wed, 2 Mar 2011 11:53:27 -0800

Oops, just noticed a typo in my previous message, I meant:

" The part that's puzzling me is the RFC says the client authenticates using *both* the Client Credentials and the _Temporary_ Credentials in the Token Credentials Request.  I could understand one or the other, but why both? (and incidentally, how can it provide both?)  Clearly the _Temporary_ Credentials identifier is needed, as it is part of the Token Credentials Request; it's only the shared secret I'm wondering about (the "oauth_token_secret" part of the reponse to the Temporary Credentials Request)."

Sorry!

- Craig.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Craig Heath
Sent: 02 March 2011 18:05
To: [email-masked]
Subject: [OAUTH-WG] RFC5849 - Purpose of Temporary Credentials Shared Secret?

- Craig Heath.

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 2 Mar 2011 13:26:57 -0700

Because it uses the same method of making authenticated requests as everything else. It's just a result of pushing everything through a single function.

EHL

From: [email-masked] [mailto:[email-masked]] On Behalf Of Craig Heath
Sent: Wednesday, March 02, 2011 10:05 AM
To: [email-masked]
Subject: [OAUTH-WG] RFC5849 - Purpose of Temporary Credentials Shared Secret?

- Craig Heath.