The client after receives an access token (which is also entails his certificate in a hash format) from the authorization server is ready to communicate with the protected resource.
- The token is presented after the mutual TLS between the client and the resource server?
- How the resource server validates the client΄s token? In fact, am not sure if the protected resource validates the token or the hash information of the certificate that is inside it or both of them.
I am reading the following but is not clear to me
"The protected resource MUST obtain, from its TLS implementation layer, the client certificate used for mutual TLS and MUST verify that the certificate matches the certificate associated with the access token"
Also at the beginning of the manual is states that
"The protected resource validates the access token in order to authorize the request. In some cases, such as when the token is self-contained and cryptographically secured, the validation can be done locally by the protected resource. Other cases require that the protected resource call out to the authorization server to determine the state of the token and obtain meta-information about it"
so the first tells that the protected resource validates the certificate and the second that the protected resource validates the token.
Which of the two operations is performed?