xtuple/passport-oauth2-jwt-bearer — pull request #5 by jaredhanson (2013-09-11 22:37:08+00:00)
Title: Get assertion from correct parameter, and check type

When used for authentication, the spec states that assertions should be in a `client_assertion` param. This patch fixes the strategy to look for the assertion in that param, and thus allows requests that contain assertions as both credentials and grants.

The patch also checks that `client_assertion_type` matches the expected value for JWTs, allowing endpoints to use both JWT and SAML assertions, if needed.

References:

http://tools.ietf.org/html/draft-ietf-oauth-assertions-12#section-4.2
http://tools.ietf.org/html/draft-ietf-oauth-jwt-bearer-06#section-2.2