Subject: [OAUTH-WG] OAuth 1.0 token assertion to OAuth 2.0 token (was: Draft -09)

From: Marius Scurtescu <[email-masked]>
Date: Tue, 29 Jun 2010 18:12:50 -0700

On Tue, Jun 29, 2010 at 8:22 AM, Eran Hammer-Lahav <[email-masked]> wrote:
>
> The assertion grant type is really the grant type extension point. Libraries should treat it as a way to support custom grant types. One of the things I would like to see someone draft is how to use OAuth 1.0 tokens to obtain OAuth 2.0 tokens using the assertion type. For example, the assertion type can be "http://oauth.net/1.0/token" , and the assertion itself is some form of the token and signature (or secrets) concatenated into a string (this will maintain the 1.0 security while transitioning to 2.0). This is just a straw man.
>
> It is important that libraries support this extensibility with some form of a hook or handler so that clients can make requests using assertions from outside the library.

An OAuth 1 token assertion as described above would achieve the same
thing as the suggested bridge endpoint. Do you see any advantages on
using an assertion as opposed to a standard OAuth 1 signed request?

Marius

---

From: Luke Shepard <[email-masked]>
Date: Tue, 29 Jun 2010 18:30:04 -0700

One reason is that you may want to exchange tokens in a batch, whereas you typically can only sign requests individually.

On Jun 29, 2010, at 6:12 PM, Marius Scurtescu wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Marius Scurtescu <[email-masked]>
Date: Tue, 29 Jun 2010 18:50:12 -0700

> One reason is that you may want to exchange tokens in a batch, whereas you typically can only sign requests individually.

How does the assertion grant type help in this case? As far as I can
tell this also allows you to exchange only one token.

Marius

---

From: Luke Shepard <[email-masked]>
Date: Tue, 29 Jun 2010 21:29:08 -0700

That's a good point :) We may want to allow batch exchanges for an upgrade flow, but you're right, then that doesn't really apply here.

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 30 Jun 2010 08:13:59 -0700

No benefit. This would just be the "2.0 way" of doing it.

EHL

> -----Original Message-----
> From: Marius Scurtescu [mailto:[email-masked]]
> Sent: Tuesday, June 29, 2010 6:13 PM
> To: Eran Hammer-Lahav
> Cc: OAuth WG ([email-masked])
> Subject: OAuth 1.0 token assertion to OAuth 2.0 token (was: Draft -09)
> 
> > The assertion grant type is really the grant type extension point. Libraries
> should treat it as a way to support custom grant types. One of the things I
> would like to see someone draft is how to use OAuth 1.0 tokens to obtain
> OAuth 2.0 tokens using the assertion type. For example, the assertion type
> can be "http://oauth.net/1.0/token" , and the assertion itself is some form
> of the token and signature (or secrets) concatenated into a string (this will
> maintain the 1.0 security while transitioning to 2.0). This is just a straw man.
> >
> > It is important that libraries support this extensibility with some form of a
> hook or handler so that clients can make requests using assertions from
> outside the library.
> 
> thing as the suggested bridge endpoint. Do you see any advantages on using
> an assertion as opposed to a standard OAuth 1 signed request?
> 
> Marius

---

From: Marius Scurtescu <[email-masked]>
Date: Wed, 30 Jun 2010 10:31:27 -0700

> No benefit. This would just be the "2.0 way" of doing it.

I see, and that's a good point.

>From an implementation perspective, clients and servers that support
OAuth 1 can easily implement a signature based bridge endpoint. The
OAuth 1 assertion will require both parties to implement new signature
code, and that can be challenging.

Marius