cedadev/ndg_oauth — pull request #1 by wvengen (2012-12-03 11:53:19+00:00)
Title: ndg_auth_server enhancements

Adds:
* '''password-based client authentication''', which is a commonly used client authentication method
* '''resource authentication for the check_token endpoint''', to avoid brute-force attacks on token check; also lays a basis for audience-restricted tokens.

Resource and client authentication use the same classes, and now are instantiated with a string indicating their use (to give meaningful log messages). The client_authenticator interface was removed, since all authenticators can derive directly from authenticator_interface, since they're both used for clients and resources; they were also renamed to make that clear (removing `_client`).

In `client_register.ini` and `resource_register.ini` (the latter is new) the field `secret` is optional. The field `authentication_data` is still mandatory for clients, but I think it would make sense to make that optional as well, since it is not used for password-based client authentication. Resource authentication already has that (since it is new anyway).

Client code is unchanged.