Subject: [kitten] OAuth mechanism and multiple auth types

From: William Mills <[email-masked]>
Date: Wed, 2 Feb 2011 13:20:18 -0800

OAuth 2.0 has morphed somewhat, and now we have the OAuth 2.0 framework for authenticating and fetching credentials, and separate specs for different kinds of credentials and methods for accessing services, i.e. bearer tokens and MAC tokens.  These access methods are stand-alone and independent of the way they are obtained (OAuth) from the server perspective.  

Should each of these access types have a separate mechanism (I think so), or should I define a mechanism that accepts multiple types of authentication/authorization within the OAuth framework?  I am expecting to return OAuth specific endpoint discovery information, so that clients can determine the correct OAuth endpoint to use to access the service.

If we have multiple mechanisms, is a separate draft spec preferred for each one, or can I go ahead and put them together in the same document?

Thanks,

-bill