The spec describes the access token as an identifier. One of the key capabilities of WRAP was that the token could be self contained. The PR could make an access control decision by examining the access token and not calling the AS.
The token is referred to as an identifier in the Abstract, Introduction, and in 2.1 access token. Similarly, the Refresh Token can be a self contained token and not an identifier contrary to the definition in 2.1 This also comes up in S 3. Obtaining an Access Token > When issuing an access token, the authorization server MUST retain the > scope, duration, and > other access attributes granted by the resource owner, and enforce > these restrictions when > receiving a protected resource request made with the access token > issued. This paragraph is not true if the AS embeds the scope, duration etc. into the token itself. This paragraph implies that the PR calls the AS with the access token. This is not needed if the access token is self contained. -- Dick
_______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
