[13] 通常の [[OAuth]] の処理 ([[3-Legged OAuth]]) に対して、
([[サーバー]]と[[クライアント]]だけ関与して[[資源所有者]]がいないなどの理由で)
一部の処理を省いたものを、
[DFN[0-Legged OAuth]],
[DFN[1-Legged OAuth]],
[DFN[2-Legged OAuth]]
などと呼ぶようです。

[14] 明確な共通仕様は存在せず、色々な[[サーバー]]がそれぞれの形態で実装しています。
概ね似たようなものですが、細部には違いがあるようです。

[15] いずれも [[OAuth 1.0]] の[[認証された要求]]を用いるものです。




[1] [CITE@ja[OAuth 1.0 for Web Applications - Google Accounts Authentication and Authorization — Google Developers]]
([TIME[2014-12-12 09:19:57 +09:00]] 版)
<https://developers.google.com/accounts/docs/OAuth#GoogleAppsOAuth>

[FIG(quote)[
[FIGCAPTION[
[2] [CITE[OAuth on Bitbucket - Bitbucket - Atlassian Documentation]]
([TIME[2015-03-05 18:57:21 +09:00]] 版)
<https://confluence.atlassian.com/display/BITBUCKET/OAuth+on+Bitbucket>
]FIGCAPTION]

> We support both 3-Legged and 2-Legged OAuth.

]FIG]


[3] [CITE@en[camme/passport-http-2legged-oauth]]
([TIME[2015-03-05 19:03:36 +09:00]] 版)
<https://github.com/camme/passport-http-2legged-oauth>

[FIG(quote)[
[FIGCAPTION[
[4] [CITE@ja[2-legged OAuthによるAPIアクセス << mixi Developer Center (ミクシィ デベロッパーセンター)]]
([TIME[2015-01-09 16:42:40 +09:00]] 版)
<http://developer.mixi.co.jp/appli/spec/mob/2-legged-oauth/>
]FIGCAPTION]

> xoauth_requestor_id	(モバイル版アプリ)リクエストパラメータとして送られてくるopensocial_owner_idを設定
> (PC版アプリ)ViewerのIDを設定

]FIG]


[FIG(quote)[
[FIGCAPTION[
[5] [CITE@ja[2-legged OAuthによるAPIアクセス << mixi Developer Center (ミクシィ デベロッパーセンター)]]
([TIME[2015-01-09 16:41:56 +09:00]] 版)
<http://developer.mixi.co.jp/appli/spec/touch/using_restful_api/2-legged-oauth-api-access/>
]FIGCAPTION]

> mixiアプリにて利用可能なRESTful APIへアクセスするには、2-legged OAuthによる適切な署名が必要です。

]FIG]


[FIG(quote)[
[FIGCAPTION[
[6] [CITE@ja[OAuth認証方法について - GREE Developer Center]]
([TIME[2015-03-06 00:43:15 +09:00]] 版)
<https://docs.developer.gree.net/ja/globaltechnicalspecs/oauth>
]FIGCAPTION]

> xoauth_requestor_id	アプリを実行しているGREEユーザーID	ユーザーからデベロッパー様サーバーへのリクエストに含まれる、クエリパラメータのopensocial_viewer_idの値(初回アクセス時のみ付与されます)

]FIG]


[FIG(quote)[
[FIGCAPTION[
[7] [CITE@ja[OAuth認証方法について(GREE Platform for Feature Phone) - GREE Developer Center]]
([TIME[2015-03-06 00:46:13 +09:00]] 版)
<https://docs.developer.gree.net/ja/technicalspecs/featurephone/oauth>
]FIGCAPTION]

> xoauth_requestor_id	アプリを実行しているGREEユーザーID	ガジェットサーバーからデベロッパー様サーバーへのリクエストに含まれる、クエリパラメータopensocial_viewer_idの値

]FIG]


[FIG(quote)[
[FIGCAPTION[
[8] [CITE[リクエストの署名 - Smartphone App - Mobage Developers Documentation Center]]
([TIME[2015-03-06 00:48:28 +09:00]] 版)
<https://docs.mobage.com/display/JPSA/REST_API_Signing_Request_JP>
]FIGCAPTION]

> 2-legged 方式と 3-legged 方式は基本的には同じ処理を行いますが、3-legged 方式では Access Token を OAuth パラメータのリストに加え、ハッシュ時のキーは Consumer Secret と Access Token Secret の両方を利用します。

]FIG]


[FIG(quote)[
[FIGCAPTION[
[9] [CITE@en-US[Spring Security Tutorial: 0-Legged OAuth 1.0]]
([TIME[2015-03-06 09:53:00 +09:00]] 版)
<http://codehustler.org/blog/spring-security-tutorial-0-legged-oauth-1-0/>
]FIGCAPTION]

> The first question is what is 0-Legged OAuth? People usually confuse 2-Legged or 1-Legged OAuth for what is effectively 0-Legged OAuth.
> What we’re going to be doing is by-passing all of the steps above (i.e. 0-Legs) and making use of the OAuth Signature for authentiation. 

]FIG]


[FIG(quote)[
[FIGCAPTION[
[10] [CITE@en-US[Spring Security Tutorial: 2-Legged OAuth 1.0]]
([TIME[2015-03-06 09:55:11 +09:00]] 版)
<http://codehustler.org/blog/spring-security-tutorial-2-legged-oauth-1-0/>
]FIGCAPTION]

> Although the Spring documentation has a page regarding 2-Legged OAuth 1.0, this is in fact not a 2-Legged implementation. If you look at our post on 0-Legged OAuth 1.0 you will notice that this is what is actually implemented by the Spring OAuth library. 
> Personally I would recommend using 0-Legged OAuth rather than using the 2-Legged version which simply introduces extra trips back and forth between the consumer and the provider.

]FIG]


[FIG(quote)[
[FIGCAPTION[
[11] [CITE@en[Technical details of UserVoice API - UserVoice Developer]]
([[UserVoice]] 著, [TIME[2015-01-24 06:02:32 +09:00]] 版)
<https://developer.uservoice.com/docs/api/technical-details/>
]FIGCAPTION]

> 2-legged OAuth requests- Requests made on behalf of the client not on behalf of any specific user (see any API endpoints marked as requiring a Trusted Client) ex: Retrieving all users for a site, Getting a list of ideas for a private forum.

]FIG]


[FIG(quote)[
[FIGCAPTION[
[12] [CITE@en[Authentication — Marketplace API 2.0 documentation]]
([TIME[2015-06-24 10:24:58 +09:00]] 版)
<http://firefox-marketplace-api.readthedocs.org/en/latest/topics/authentication.html>
]FIGCAPTION]

> Marketplace provides OAuth 1.0a, allowing third-party apps to interact with its API. It provides it in two flavours: 2-legged OAuth, designed for command line tools and 3-legged OAuth designed for web sites.

]FIG]