> I'm concerned that forcing the AS to know about all RS's endpoints that will 
> accept it's tokens creates a very brittle deployment architecture

The AS is issuing temporary credentials (access_tokens) to clients but doesn’t 
know where those credentials will work? That’s broken.

An AS should absolutely indicate where an access_token can be used. 
draft-sakimura-oauth-meta suggests indicating this with 1 or more “ruri” 
(resource URI) values in an HTTP Link header. A better approach would be 
including a list of web origins in the token response beside the access_token 
field.

--
James Manger

From: OAuth [mailto:oauth-boun...@ietf.org] On Behalf Of George Fletcher
Sent: Thursday, 25 February 2016 6:17 AM
To: Phil Hunt <phil.h...@oracle.com>; Nat Sakimura <sakim...@gmail.com>
Cc: <oauth@ietf.org> <oauth@ietf.org>
Subject: Re: [OAUTH-WG] OAuth 2.0 Discovery Location

I'm concerned that forcing the AS to know about all RS's endpoints that will 
accept it's tokens creates a very brittle deployment architecture. What if a RS 
moves to a new endpoint? All clients would be required to get new tokens (if I 
understand correctly). And the RS move would have to coordinate with the AS to 
make sure all the timing is perfect in the switch over of endpoints.

I suspect a common deployment architecture today is that each RS requires one 
or more scopes to access it's resources. The client then asks the user to 
authorize a token with a requested list of scopes. The client can then send the 
token to the appropriate RS endpoint. The RS will not authorize access unless 
the token has the required scopes.

If the concern is that the client may accidentally send the token to a "bad" RS 
which will then replay the token, then I'd rather use a PoP mechanism because 
the point is that you want to ensure the correct client is presenting the 
token. Trying to ensure the client doesn't send the token to the wrong endpoint 
seems fraught with problems.

Thanks,
George
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth

Reply via email to