1.2. Protocol Flow - figure 1 is misleading

[tlodderstedt]

In a discussion with OAuth implementers the following issue was raised:

The first messages of the flow show that the client obtains the grant from the resource owner and passes it the AS. That might work for RO password grant but it does not work that way for code and other grant types. The text on step 1 is resolving this issue by stating:

The client requests authorization from the resource owner. The authorization request can be made directly to the resource owner (as shown), or preferably indirectly via the authorization server as an intermediary.

I would say with OAuth 2.1 the authorization is always captured by the AS. I suggest to modify figure and description accordingly.

[dickhardt]

I think the diagram is correct in the steps as an abstract flow -- the descriptions of each step is confusing. I'm confused by what "preferably indirectly via the authorization server as an intermediary." is to mean.

[aaronpk]

Related: #26