[OAUTH-WG] Scope parameter values for "authorization_code" and "client_credentials" based access tokens

["Donald Coffin" <[e-mail]>]

I would like to get the views and comments of the OAuth 2.0 IETF WG on the
following design and implementation question:

 

I have an application that supports both "authorization_code" and
"client_credentials" based access tokens.  The application allows a client
to obtain data on a nightly basis for resource owners who have granted the
application access to their data.  The client application retrieves energy
usage information and can potentially need to retrieve data from a few
accounts to several million accounts.  In order to eliminate the need for
the client application to request the data from the resource server one
account at a time, the client application has been designed to support
"client_credentials" based access tokens.  Per [RFC 6749 Section 4.4 -
"Client Credentials Grant"] The use of the "client_credentials" based access
token will allow the client application to obtain access to the data with a
single request, thus significantly reducing the amount of network traffic
for both the client and the resource server.

 

The question the design team is struggling with is what should the Scope
string be for the "client_credentials" based access token and should there
be a single access token or can there be multiple "client_credentials" based
access tokens?

 

The client application currently supports the following Scope definitions:

 

.
FB=4_5_15;IntervalDuration=900;BlockDuration=monthly;HistoryLength=13



.
FB=4_5_16;IntervalDuration=900;BlockDuration=monthly;HistoryLength=13

 

There are several allowable values for the FB=, IntervalDuration=,
BlockDuration=, and HistoryLength= values.  At the moment, there are only
two defined Scope values, but as you can see, there could easily be many
more potential possibilities.  

 

The question being discussed, is does the "client_credentials" access token
request Scope parameter need to match either of the above two strings or can
it be something altogether different?  In the event the "client_credentials"
access token request Scope parameter needs to match a defined Scope string,
does that mean that there MUST be multiple "client_credentials" based access
tokens?

 

Thanks in advance for helping clarify our understanding of the relationship
between "authorization_code" and "client_credentials" based access tokens.

 

Best regards,

Don

Donald F. Coffin

Founder/CTO

 

REMI Networks

22751 El Prado Suite 6216

Rancho Santa Margarita, CA  92688-3836

 

Phone:      [phone]

Email:       [e-mail]