I'd appreciate if someone could clear up if, according to the OAuth2 RFC, the resource server could infer the user associated to an access token or not, or even if that is expected.
Let’s assume the following:
- The authorization server and the resource server are separated and independent.
- The client is a printing service.
- The resource server hosts user photos.
- The client wants to invoke a protected API from the resource server to get user's photos https://es/api/users/USER_ID/photos and print them.
- The client redirects the user to the independent authorization server and ends up generating an access token.
- The client uses that access token to get and print some user photos.
Since the token is opaque and has no meaning to the independent resource server nor the client, nothing would prevent the client from using that access token to access and print photos from any user, not only the one who authorized it.
Is this right? Or otherwise, how does the resource server relate the user to the token to limit its usage?