I am looking for any specifications, prior art, and known security considerations for a specific OAuth2 use case where:
- an authorization code grant is being performed.
- the client does not know the resource server ahead of time.
- the resource server will be determined by the authorization server, e.g. based on the user's identity.
You can imagine that the authorization server is used as an entryway to many resource servers where each user is assigned to just one resource server, and the authorization server issues credentials that the resource servers can verify. Once the client receives credentials from the token endpoint it needs to infer the resource server and then begin communicating with it.
I am aware that the access token may contain an audience field (or be introspected via an endpoint as in RFC 7662), but my impression is that the intention is for the audience to be verified by the resource server, not intended to be utilized by the client. I could imagine security implications of the authorization server dictating which resource server the client should talk to, but I haven't found any good material on this. I also haven't come across any specifications with this use case in mind, describing how the authorization server should indicate the resource server to the client (in the access token? in a response field from the token endpoint?).
If anyone has experience with this or knows of any standard approaches I'd greatly appreciate your thoughts.