Adam,

I’ll chime in and say you have a reasonable requirement (getting tokens with 
different scopes (for different resource servers) efficiently). Over the last 
few years there have been a number of proposals for OAuth to support this (by 
allowing an authorization server to return multiple tokens, each with their own 
scope). Unfortunately, despite some support, the proposals were rejected for 
the core spec. There was strong resistance to any complexity that wasn’t 
absolutely necessary for the basic use case — and flexibility for likely 
(though maybe niche) scenarios such as yours was not sufficient motivation.

As it turns out, one significant early use of OAuth2 does need an extra token 
(the ID token in OpenID Connect). That is being supported with some additions 
to OAuth2 that are highly specific to OpenID Connect so it does not help your 
requirement.

--
James Manger

From: [email protected] [mailto:[email protected]] On Behalf Of Lewis 
Adam-CAL022
Sent: Thursday, 1 November 2012 4:01 AM
To: [email protected]
Subject: [OAUTH-WG] access tokens & refresh tokens of different scopes

I have a use case where I would like to request both an access token and a 
refresh token, but I would like the access token to have a scope less than that 
of the refresh token.  It is standard OAuth behavior for using the refresh 
token to request additional access tokens (of equal or lesser scope) but the 
first access token that comes back always has the “master scope” of the refresh 
token.

For various security concerns, I always want my access tokens to be of a 
stricter scope that the refresh token.  For example, consider the scenario of a 
structured (JWT) access token that does not require the RS to call back to the 
AS introspection endpoint.  Following typical OAuth guidance, it is best 
practice to use short lived access tokens with long lived refresh tokens.  But 
I’d rather a compromised access token not compromise access to ALL my resource 
servers.

Using the existing standard I could simply destroy the first access token when 
it is received and then request another of lesser scope using the refresh 
token, but now I’ve just wasted a round trip over the air, consuming bandwidth 
and adding latency to the end user experience.

Is there anybody in the working group that feels this would be valuable?


adam
_______________________________________________
OAuth mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/oauth

Reply via email to