demandforce/rack-oauth2-server — pull request #32 by bploetz (2012-02-17 23:23:49+00:00)
Title: Jwt bearer

Hi,

I've added support for JWT bearer tokens via the assertion grant_type.

http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-4.1.3
http://tools.ietf.org/html/draft-jones-oauth-jwt-bearer-03
http://tools.ietf.org/html/draft-jones-json-web-token-07

Note that (like the OAuth2 spec itself) the jwt-bearer spec is still evolving. Further, it's written assuming a later version of the OAuth2 spec, and unfortunately rack-oauth2-server has been stuck on version 10 of the OAuth2 spec for some time. Luckily, it was pretty easy to adapt to version 10 of the OAuth2 spec.

Along those lines, I want to start modularizing the internals of rack-oauth2-server such that it can support *multiple* versions of the OAuth2 spec, and users would simply configure which version of the spec that they want to use. Obviously I'll deal with that in a separate pull request, but just a heads up.

Any question/comments/concerns, let me know.

Thanks,
Brian