Repository navigation
Composeable client scopes #14417
alechenninger
started this conversation in
Ideas
Composeable client scopes
#14417
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Scenario
Problem
In order for a client to get appropriate authorization, it has to know that RS1 relies on RS2. This couples the client to potential implementation detail of RS1. If RS1 changes, it's potentially either a breaking change for clients, unless a downstream resource server forgoes scope validation. Or, if RS1 changes to no longer require RS2, the client is requesting unnecessary authorization.
This applies to the case that a downstream service requires anything about tokens or userinfo, such as audience, scopes, or other claims.
Suggestion
Allow composing scopes such that some scope for RS1 can be composed of another scope for RS2. Then, when a Client requests a scope (RS1), all scopes included in RS1 are implicitly requested as well (e.g. the user is asked for consent for both RS1 and RS2 scopes in this case). If not consent is required, the client is automatically granted explicit and implicit scopes.
Alternatives
All reactions