'First step in [OAuth 2.0](http://oauth.net/2/) authentication.
End users will be prompted for their credentials (username/password)
and asked if they wish to authorize the application identified by
the **client_id** parameter with the permissions specified by the
**scope** parameter.  They are then redirected to the endpoint on
the client application\'s side specified by **redirect_uri**.
If the user granted permission to the application, the response will
contain a **code** parameter with a temporary authorization code
which can be exchanged for an access token at
[/api/v1/access_token](#api_method_access_token).
**redirect_uri** must match the URI configured for the client in the
[app preferences](/prefs/apps).  All errors will show a 400 error
page along with some information on what option was wrong.'

@validate(VUser(), response_type=VOneOf('response_type', ('code', 'token')), client=VOAuth2ClientID(), redirect_uri=VRequired('redirect_uri', errors.OAUTH2_INVALID_REDIRECT_URI), scope=VOAuth2Scope(), state=VRequired('state', errors.NO_TEXT), duration=VOneOf('duration', ('temporary', 'permanent'), default='temporary'))
def GET_authorize(self, response_type, client, redirect_uri, scope, state, duration):

    self._check_employee_grants(client, scope)
    self._check_redirect_uri(client, redirect_uri)
    self._check_response_type_and_scope(response_type, scope)
    self._check_client_type_and_duration(response_type, client, duration)
    if (not c.errors):
        return OAuth2AuthorizationPage(client, redirect_uri, scope, state, duration, response_type).render()
    else:
        self._abort_oauth_error(errors.INVALID_OPTION)
