I think the problem is that OAuth isn't usually touted as a sign-on standard, only an "access API info" standard. With a couple tiny tweaks OAuth could be a sta

I think the problem is that OAuth isn't usually touted as a sign-on standard, only an "access API info" standard. With a couple tiny tweaks OAuth could be a standard that allows for this kind of "Connect" protocol for any web application. Specifically, all that would need to happen to make this perfect is for OAuth requests for a user that already have an access token automatically push through to the callback phase instead of requiring a "re-allow" of the client's services. This wouldn't conflict with the OAuth spec in any way that I'm aware of.