Subject: [OAUTH-WG] Seeking clarity on Section 4.3 and the specification of client credentials

From: Todd W Lainhart <[email-masked]>
Date: Tue, 4 Oct 2011 16:52:41 -0400

Although it seems like an abuse of the protocol, I'm wondering at Draft 22 
as a mechanism for providing authorization without specifying client 
credentials (i.e. evaluating it as part of an SSO solution). 

Specifically, I'm referencing the scenario/flow in Section 4.3 ("Resource 
Owner Password Credentials") where a callback_uri parameter is not 
specified. Assume that the client type is "public". 

I'm also referencing Section 2.4, "Unregistered Clients", where the text 
says that the spec does not exclude the use of unregistered clients (with 
the appropriate disclaimers).

Under these conditions then, can I then expect a spec-compliant 
authorization server to not require client credentials when requesting an 
access token?

  -- Todd