Re: [OAUTH-WG] Auth Server / Resource Server Coordination

[Ofer Nave <[e-mail]>]

BTW -- I'd like to say I'm very pleasantly surprised by the quantity,
quality, and speediness of all your responses.  I assumed this list was
low-attention based on glancing at the archives, but maybe that's just
because ya'll already know everything you need to know and noobs are rare.
:)

-ofer

On Tue, Oct 13, 2015 at 12:13 AM, Ofer Nave <[e-mail]> wrote:

> I know the OAuth 2.0 RFC doesn't specify any standards for coordination
> between the Authorization Server and the Resource Server, as it's generally
> assumed that both will be owned or operated by the same entity.
>
> However, I'm building an OAuth 2.0 Auth Server, and I'd like to add a
> feature to make it easy for other API developers to delegate to me the
> responsibility of handling the auth grant process and issuing access tokens.
>
> It seems to me that a simple version of this could be easily done by:
>
> 1) Defining an Access Token format that contains within it everything a
> Resource Server will need to validate it and determine the level of access
> granted (list of scopes, expiration datetime, HMAC signature using a shared
> secret).
>
> 2) Providing a means (basic web UI) for Resource Server owners to register
> a set of scopes for their service, along with user-understandable
> descriptions of each to display when they arrive at my Authorization
> Endpoint.
>
> While I've read the relevant RFCs, I'm new to the OAuth domain, and would
> appreciate any feedback. Is this a stupid idea?  Is this a good idea, but
> redundant with another standard I'm not aware of?
>
> -ofer
>