[OAUTH-WG] invalid_scope in access token request

Aaron Parecki <aaron@parecki.com> Tue, 07 July 2015 04:23 UTC

MIME-Version: 1.0
Date: Mon, 06 Jul 2015 21:23:15 -0700
Message-ID: <CAGBSGjpnSndyXWBKwvHH8mKX_79fv31aeTXrFfKyFTJ5dO1T2g@mail.gmail.com>
From: Aaron Parecki <aaron@parecki.com>
To: OAuth WG <oauth@ietf.org>
Content-Type: multipart/alternative; boundary="089e010d9566902e08051a4161cc"
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/QEBurUZ2NR7qUg_a1jryh5e7TBk>
Subject: [OAUTH-WG] invalid_scope in access token request
Precedence: list

Section 5.2 lists the possible errors the authorization server can return
for an access token request. In the list is "invalid_scope", which as I
understand it, can only be returned for a "password" or
"client_credentials" grant, since scope is not a parameter of an
"authorization_code" grant.

Because of this, I believe the phrase "or exceeds the scope granted by the
resource owner." is unnecessary, since there is no initial grant by the
resource owner. Am I reading this correctly, or is there some situation I
am not thinking of? Thanks!

----
Aaron Parecki
aaronparecki.com
@aaronpk <http://twitter.com/aaronpk>

[OAUTH-WG] invalid_scope in access token request Aaron Parecki
Re: [OAUTH-WG] invalid_scope in access token requ… Antonio Sanso
Re: [OAUTH-WG] invalid_scope in access token requ… Aaron Parecki
Re: [OAUTH-WG] invalid_scope in access token requ… John Bradley
Re: [OAUTH-WG] invalid_scope in access token requ… Aaron Parecki