Let's take an example where there are two resource servers - RS1 and RS2 and there is one authorization server - AS.
Both resource servers - RS1 and RS2 use authorization server - AS
If a client requests an access token for RS1 and passes it to RS2, how will RS2 validate it and fail?
One possibility is to depend on scope checks - but it seems scope checks are nothing more than string comparisons (or am I wrong here?). In that case, if both RS1 and RS2 define exactly the same scope name (e.g. Read
) then there is no reliability even with scopes.