Hi Jaap,

There have been a number of efforts to address this kind of thing in the OAuth 
world. You can definitely use a special scope to encode this value, which has 
the benefit of fitting into the implementation limitations of nearly all OAuth 
systems out there. The “resource” parameter can also be used for the kind of 
thing, and it gives you a bucket that’s separate from “scope” so that you can 
keep the latter available for describing the API itself:

https://tools.ietf.org/html/rfc8707 <https://tools.ietf.org/html/rfc8707>

There’s also the Rich Authorization Request (RAR) draft that this group is 
currently working on, which provides a multi-dimensional way to describe 
access. It’s more complex than scopes, but it boils down to having JSON objects 
describe the elements needed. In this case you might put the API bits into the 
“actions” and “datatypes” fields, and put the tenant information into the 
“locations” field. I believe there are people using it in exactly this way 
today:

https://tools.ietf.org/html/draft-ietf-oauth-rar-03 
<https://tools.ietf.org/html/draft-ietf-oauth-rar-03>

There are also some historical efforts to address this, including an “audience” 
and a (completely separate) “aud" parameter, but AFAIK neither of these have 
been raised to standard or even to common practice, and so I wouldn’t recommend 
it. I currently have a project to migrate a system that’s currently using one 
of these onto RAR.

 — Justin

> On Jan 12, 2021, at 11:20 AM, Jaap Francke 
> <Jaap.Francke=40mendix....@dmarc.ietf.org> wrote:
> 
> Hi,
>  
> I’m looking into the topic of tenancy. A multi-tenant service can be 
> considered as an OAuth Resource Server managing resources of different 
> tenants.
> An AS makes authorization decisions and communicates these using scopes, so 
> one way would be to ‘encode’ the tenant into the scope values.
> Another line of thought is to somehow bind/restrict an acces-token to a 
> certain tenant, leaving the set of scopes being used more static.
>  
> My question is whether this has been a topic that has been addressed in the 
> OAuth working group? Any common practice or draft?
> Thanks in advance for your replies.
>  
> Kind regards,
>  
> Jaap Francke
> Product Manager Identity
> +31(0)641495324
> mendix.com <http://mendix.com/>
> <image001.png> <http://www.mendix.com/>
>  
>  
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org <mailto:OAuth@ietf.org>
> https://www.ietf.org/mailman/listinfo/oauth 
> <https://www.ietf.org/mailman/listinfo/oauth>
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth

Reply via email to