On 7/8/10 11:37 PM, "Brian Eaton" <[email protected]> wrote:
> 1.4.4 Autonomous
>
> I think we need a better definition of Autonomous Clients, but I'm
> damned if I can think of one right now.
>
> "The scope of the access
> token is limited to the protected resources under the control of
> the client, or that of another resource owner previously arranged
> with the authorization server."
>
> That sounds a lot more complicated than it is.
>
> How about "The access token does not allow the client to act on behalf
> of an end-user. The token identifies the client, and so is scoped to
> the resources to which the client has direct access."
This is not true. Autonomous means the authorization is external to the
authorization server (i.e. another trust framework). An assertion can still
represent an end-user. Previous texts positioned autonomous as the client
acting on its own behalf which was largely rejected by the group.
EHL
_______________________________________________
OAuth mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/oauth
