<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font size="+1"><font face="Arial">For those apps that already have
an OAuth infrastructure (ie an AS and a set of RS that are set
up to 'trust' access tokens issued by that AS) the proposal is
that the TA would exchange an appropriately targeted id_token at
that AS to obtain the desired access token - a two part exchange
like this<br>
<br>
1) TA ------ refresh token ------- > Home AS<br>
2) TA <-------- id_token ----------- Home AS<br>
<br>
3) TA --------- id_token ------------ Remote AS<br>
4) TA <----- access token -------- Remote AS<br>
<br>
begs the question 'How does the TA know the Remote AS token
endpoint address?'<br>
<br>
Ignoring hard coded, options include<br>
<br>
1) returned in the AppInfo response for that app<br>
2) returned in the id_token (step 2 above)<br>
3) passed in by the native app on its request to the TA<br>
<br>
Thoughts?<br>
<br>
paul<br>
</font></font>
</body>
</html>