Re: [OAUTH-WG] Client credentials for native applications: seeking clarification

2011-10-22 Thread Torsten Lodderstedt
http://tools.ietf.org/html/draft-recordon-oauth-v2-device-00 Forest schrieb: Thanks for the clarification. The subtle difference makes sense to me, and indeed was what prompted me to address this list in the first place. It *is* subtle, though, and the oauth-v2-22 draft doesn't even hint at i

Re: [OAUTH-WG] Client credentials for native applications: seeking clarification

2011-10-21 Thread Forest
Thanks for the clarification. The subtle difference makes sense to me, and indeed was what prompted me to address this list in the first place. It *is* subtle, though, and the oauth-v2-22 draft doesn't even hint at it until six sections after a very clear "MUST" statement apparently forbidding th

Re: [OAUTH-WG] Client credentials for native applications: seeking clarification

2011-10-21 Thread Torsten Lodderstedt
Hi, there is no contradiction. The subtle difference lays in the word "instance". Using secrets for a software package (and all of its installations) is useless and therefore not allowed. If you are able to issue a distinct id/secret pair to every installation of your app, this is fine. For a

[OAUTH-WG] Client credentials for native applications: seeking clarification

2011-10-20 Thread Forest
Hi there. I've been considering OAuth 2 and its "client credentials" grant type for use with applications that run on televisions and other consumer devices. It is appealing mainly because it requires no built-in web browser and no cumbersome data entry for the user. (Similar to the Netflix devic