0

According to RFC 6749 the strings [scopes] are defined by the authorization server.

However isn't it really the resource server who defines the scopes? I mean scopes vary from resource server to resource server, no? Even if they are registered with the same authorization server.

Improve this question

1 Answer 1

Reset to default
0

After having thought about it for a while... it should be correct to say that the authorization server defines the scopes and the resource server implements them.

A client requests authorization for a scope which the user gives consent to (authorization grant). Then the client sends the authorization grant to the authorization server to get an access token in return.

That access token must contain the signed scope that the user has given consent to, which in turn means the authorization server needs to be aware of all the scopes that can be requested.

Then it's up to the resource server to:

  • Validate that token (via introspection endpoint or a cached public key)

  • Parse that token for scopes and grant/deny access.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .