Re: [OAUTH-WG] Tenancy in OAuth

[Vladimir Dzhuvinov <[e-mail]>]

Hello Jaap,

Justin made a good overview of the available OAuth facilities when
dealing with multiple resource servers or resource server tenants.

If you have control over the resource server, i.e. the token validation
is going to happen in one place, then you have plenty of freedom to find
out what will work best for you, semantically and in terms of available
OAuth server.

In cases when the resources are left to implement the token validation
on their own my preferred approach is to encode the resource server
identity (tenant) into the scope values. Access is defined in one place
and I don't have to worry about the developer accidentally forgetting
the "resource" or "aud(ience)" check.

Vladimir


On 12/01/2021 23:13, Justin Richer wrote:
> Hi Jaap,
>
> There have been a number of efforts to address this kind of thing in
> the OAuth world. You can definitely use a special scope to encode this
> value, which has the benefit of fitting into the implementation
> limitations of nearly all OAuth systems out there. The “resource”
> parameter can also be used for the kind of thing, and it gives you a
> bucket that’s separate from “scope” so that you can keep the latter
> available for describing the API itself:
>
> https://tools.ietf.org/html/rfc8707
>
> There’s also the Rich Authorization Request (RAR) draft that this
> group is currently working on, which provides a multi-dimensional way
> to describe access. It’s more complex than scopes, but it boils down
> to having JSON objects describe the elements needed. In this case you
> might put the API bits into the “actions” and “datatypes” fields, and
> put the tenant information into the “locations” field. I believe there
> are people using it in exactly this way today:
>
> https://tools.ietf.org/html/draft-ietf-oauth-rar-03
>
> There are also some historical efforts to address this, including an
> “audience” and a (completely separate) “aud" parameter, but AFAIK
> neither of these have been raised to standard or even to common
> practice, and so I wouldn’t recommend it. I currently have a project
> to migrate a system that’s currently using one of these onto RAR.
>
>  — Justin
>
>> On Jan 12, 2021, at 11:20 AM, Jaap Francke
>> <Jaap.Francke=[e-mail]
>> <mailto:Jaap.Francke=[e-mail]>> wrote:
>>
>> Hi,
>>  
>> I’m looking into the topic of tenancy. A multi-tenant service can be
>> considered as an OAuth Resource Server managing resources of
>> different tenants.
>> An AS makes authorization decisions and communicates these using
>> scopes, so one way would be to ‘encode’ the tenant into the scope values.
>> Another line of thought is to somehow bind/restrict an acces-token to
>> a certain tenant, leaving the set of scopes being used more static.
>>  
>> My question is whether this has been a topic that has been addressed
>> in the OAuth working group? Any common practice or draft?
>> Thanks in advance for your replies.
>>  
>> Kind regards,
>> * *
>> *Jaap Francke*
>> Product Manager Identity
>> [phone]
>>
>> mendix.com <http://mendix.com/>
>>
>> *<image001.png>* <http://www.mendix.com/>
>> * *
>>  
>> _______________________________________________
>> OAuth mailing list
>> [e-mail] <mailto:[e-mail]>
>> https://www.ietf.org/mailman/listinfo/oauth
>
>
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth

-- 
Vladimir Dzhuvinov