tree 0116912ba3ee1d989d9735310b119d2e90eeb95e
parent 1a0dec0b60462a42419a11c329677ed0ceb2b9da
author Ankur <ataly@google.com> 1439951263 -0700
committer Ankur <ataly@google.com> 1439951263 -0700

"x/ref/services/identity": HTTP service for BlessUsingAccessToken

Currently the only mechanism to exchange an OAuth2 access token
for a blessing is a Vanadium RPC service. Unfortunately this makes
implementing our security model on other platforms (e.g., Mojo)
depend on the RPC system.

This CL adds a REST API to exchange an OAuth2 token for a blessing.
The API takes an OAuth2 token, the client's public key and caveats,
and returns a blessing bound to the provided public key for the
identity represented by the OAuth2 token.

The name of the resulting blessing is of the form
<idp>/<clientID>/<email> where <clientID> and <email> is the client ID
and email associated with the token respectively.

MultiPart: 1/2
Change-Id: I463fd24c2f77f03d4d1bb970336b025886368a08