The user authentication and access control to the resources is out of the OAuth scope. The question is how to make a resource (e.g., a photo) accessible by the authorized clients C1,...,Cn. If each client has obtained a user's authorization for the scopes that include the photo, then all clients' access tokens should enable them to access the photo. If for a client Ci the authorized scope does not include the photo, the client would need get a new user authorization.
The resource server would be a logical place for maintaining ACL. Zachary -----Original Message----- From: oauth-boun...@ietf.org [mailto:oauth-boun...@ietf.org] On Behalf Of Melvin Carvalho Sent: Sunday, December 18, 2011 12:06 PM To: oauth@ietf.org Subject: [OAUTH-WG] OAuth 2.0 and Access Control Lists (ACL) Quick question. I was wondering if OAuth 2.0 can work with access control lists. For example there is a protected resource (e.g. a photo), and I want to set it up so that a two or more users (for example a group of friends) U1, U2 ... Un will be able to access it after authenticating. Is this kind of flow possibly with OAuth 2.0, and if so whose responsibility is it to maintain the list of agents than can access the resource? _______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth _______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
