title: Trusted Client OAuth Token Creation?
body: <p>TL:DR;</p>
  
  <p>I have a trusted application within my VPC and I want to allow:</p>
  
  <p><code>POST /oauth/authorize? user_id=U_123, client_id=xyz, client_secret=abdfd</code> allows unlimited access to any user’s data on the assumption that client secret is secret. Is there precedence for that?</p>
  
  <hr>
  
  <p>I have been implementing a Service Oriented Architecture and one of the pieces that I'm less confident about is our application authentication and authorization. </p>
  
  <p>We have an internal application to the main API, which we have whitelisted for trusted OAuth using just the client credentials(id, secret) and the user id:</p>
  
  <p><code>POST /oauth/authorize? user_id=U_123, client_id=xyz, client_secret=abdfd</code></p>
  
  <p>Essentially, this makes it possible to generate an oauth token for a given user without password, and without displaying authorization page.</p>
  
  <p>By including the user identifier in the mix, this allows user specific tokens, and gives us the option of invalidating tokens for a single user.  In this way we don't have to invalidate the entire application, so potentially no compromise in the level of security.</p>
  
  <p>Is there any precedence for a trusted client OAuth 2.0 token creation?</p>