[OAUTH-WG] Returning tokens directly to a human user

2015-03-06 Thread Sergey Beryozkin
Hi All, We might have a requirement to support a case where AS returns an access token directly to a human user, with the user subsequently configuring a confidential client with this token. The actual client is not capable of supporting a (more dynamic) code flow at this stage. So it is nea

Re: [OAUTH-WG] Returning tokens directly to a human user

2015-03-06 Thread Dick Hardt
If you are interested in how others have done a similar flow, you could look at how smart TVs supporting Netflix and Amazon are authorized. On Fri, Mar 6, 2015 at 9:22 AM, Sergey Beryozkin wrote: > Hi All, > > We might have a requirement to support a case where AS returns an access > token direc

Re: [OAUTH-WG] Returning tokens directly to a human user

2015-03-06 Thread Justin Richer
All you’re really doing here is having a more manual and less automated portion for part of the process. You’d want to do this using a registered redirect URI that hosts the HTML page, and then you’d need a control in the app itself where the user could interact. I would personally recommend us

Re: [OAUTH-WG] Returning tokens directly to a human user

2015-03-06 Thread Sergey Beryozkin
Thanks for a reference to such applications... Sergey On 06/03/15 18:07, Dick Hardt wrote: If you are interested in how others have done a similar flow, you could look at how smart TVs supporting Netflix and Amazon are authorized. On Fri, Mar 6, 2015 at 9:22 AM, Sergey Beryozkin mailto:sberyoz.

Re: [OAUTH-WG] Returning tokens directly to a human user

2015-03-06 Thread Sergey Beryozkin
Hi On 06/03/15 18:28, Justin Richer wrote: All you’re really doing here is having a more manual and less automated portion for part of the process. You’d want to do this using a registered redirect URI that hosts the HTML page, and then you’d need a control in the app itself where the user cou

Re: [OAUTH-WG] Returning tokens directly to a human user

2015-03-06 Thread Justin Richer
> On Mar 6, 2015, at 5:31 PM, Sergey Beryozkin wrote: > > Hi > On 06/03/15 18:28, Justin Richer wrote: >> All you’re really doing here is having a more manual and less automated >> portion for part of the process. You’d want to do this using a registered >> redirect URI that hosts the HTML pag

Re: [OAUTH-WG] Returning tokens directly to a human user

2015-03-06 Thread Sergey Beryozkin
Hi Justin, Thanks for typing it all, appreciated... I guess the idea here is basically introduce a little web app 'intermediary' that will act as if it were a client except that it will show whatever it receives back from AS to the user. So we still have a common processing path at AS, as if i