I am writing a Facebook application that needs to post on a friend\'s wall on behalf of a user, but out of the scope of a canvas application. I have the following:
Actually, I think I've figured out the answer here. I don't think that there's a way to do it in the new OAuth API, but there does seem to be a way with the older REST API. See the documentation here.
Simply replace step 2 in my question with the above documentation, still using the OAuth token from step 1, and you should be good :)