I'm keen to use some of the OAuth functionality to provide a sign in for an app, however for that to work I need to be able to get an access token for an (domino) unauthenticated user.

This nearly works as i can use the API, even via the @Functions, to start the OAuth 'dance' but when the provider returns and calls the OAuth servlet it attempts to store the token in the WebTokenStore, which fails as the user is anonymous.

Could the OAuth servlet be tweaked so that if the user is unauthenticated it stores the access token details in a sessionScoped variable rather than attempting to write to tokenstore?

Thanks!