Abstract This draft describes a mechanism to combine an OpenID authentication request with the approval of an OAuth request token. Table of Contents 1.  Requirements notation 2.  Terminology 3.  Purpose of this Specification 4.  Overview 5.  Extension Namespace 6.  Discovery 7.  Before Requesting Authentication - Registration 8.  Requesting Authentication 9.  Authorizing the OAuth Request

Abstract This specification defines the concept of an Authorization Session which represents the authorization granted to the Consumer to access Protected Resources on behalf of the User. OAuth Core 1.0 assumes that the Authorization Session lifetime and the Access Token lifetime are equal. This specification defines a mechanism for Service Providers to issue Access Tokens with shorter life

2.  Notation and Conventions The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in [RFC2119] (Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels,” March 1997.). Domain name examples use [RFC2606] (Eastlake, D. and A. Panitz, “Reserved Top Level D

Abstract OAuth Core 1.0 defines a protocol for delegating user access to Consumer applications without sharing the user's private credentials. Some consumer applications use the RSA_SHA1 signature method. To verify RSA_SHA1 signatures, Service Providers need to be in possession of an authentic copy of the consumer application's public key. Whenever a consumer application changes the private key it

Abstract This memo describes a method for using the OAuth flow to sign a request made between a Consumer and Service Provider without User involvement, which is either absent or handled by other means. It enables OAuth to be used as a replacement to HTTP Basic authentication and extends the capabilities of the OAuth Consumer credentials. OAuth Core 1.0 defines a protocol for delegating user access

Abstract This specification extends the OAuth signature to include integrity checks on HTTP request bodies with content types other than application/x-www-form-urlencoded. Table of Contents 1.  Introduction 2.  Notation and Conventions 3.  The oauth_body_hash Parameter 3.1.  Hash Algorithm 3.2.  Hash Calculation 4.  Changes to OAuth Request Signing 4.1.  Sending Requests 4.1.1.  When to Inc