OAuth (even two) sucks - and not just at the implementation level. OAuth will continue to suck until it adheres to the laws of identity.
Unfortunately the alternatives look pretty bleak too. If you want to use identity federation, you're stuck with WS-* (you need the active requestor profile for thick clients), and, more fundamentally, you need an identity provider (IDP). Note that Facebook, Google and Twitter don't count - they're not justifiable parties except unto themselves.
Once you get the IDP sorted you have more options. You can use U-Prove or IDEMIX to provide anonymity, derived claims (proving you're over 18 without divulging your age) and discretionary access to claims.
Problem with all of the above is that identity selectors aren't as mature as they could be (CardSpace has been abandoned by Microsoft, and the Higgins Project doesn't have an adequate solution for putting information cards onto, say, a smart phone).
Given the sorry state of identity today, I've created my own framework which required close to 10K LOC (client and server).
It's an insane world. We still haven't managed to come up with anything better or more usable than user name and password.
You can just look at all the various revs and options that OAuth has and know that they are casting around for a correct answer.
I've implemented two oauth 1.x handshakes and both were full of one-off complications and incomprehensible error states.
I'll take a look at OAuth 2 when it becomes more prevalent, but until then no why in hell I'm moving away from a simple "generate an API key" approach.
Unfortunately the alternatives look pretty bleak too. If you want to use identity federation, you're stuck with WS-* (you need the active requestor profile for thick clients), and, more fundamentally, you need an identity provider (IDP). Note that Facebook, Google and Twitter don't count - they're not justifiable parties except unto themselves.
Once you get the IDP sorted you have more options. You can use U-Prove or IDEMIX to provide anonymity, derived claims (proving you're over 18 without divulging your age) and discretionary access to claims.
Problem with all of the above is that identity selectors aren't as mature as they could be (CardSpace has been abandoned by Microsoft, and the Higgins Project doesn't have an adequate solution for putting information cards onto, say, a smart phone).
Given the sorry state of identity today, I've created my own framework which required close to 10K LOC (client and server).
It's an insane world. We still haven't managed to come up with anything better or more usable than user name and password.