Re: [OAUTH-WG] Issue: Scope parameter

[Justin Smith <[e-mail]>]

I get the point, but I’ll set that aside for a moment.

Is it important for an Authorization Server to be able to protect multiple resources? If so, how should the client specify which resource it intends to access (it seems like that is required)?

From: [e-mail] [mailto:[e-mail]] On Behalf Of Manger, James H
Sent: Thursday, April 15, 2010 6:40 PM
To: OAuth WG
Subject: Re: [OAUTH-WG] Issue: Scope parameter

> I don’t see how the presence of a scope parameter hurts interoperability.

Scopes so far have all been specific to a specific service. Knowing how Google uses ‘scope’ tells you nothing about interoperating with Microsoft.

Requesting access to specific sets of resources is important. However, you can do it by providing different user-authorization URIs — even if the URIs only differ in the value of a ‘scope’ query parameter.

For a library that isn’t service-specific, a scope value offers no semantic value. All the library can do is tack it onto a supplied user authz URI. In which case it is simpler for the library to just accept a user authz URI that has had the scope tacked on before being passed to the library.


--
James Manger

From: [e-mail] [mailto:[e-mail]] On Behalf Of Justin Smith
Sent: Friday, 16 April 2010 9:39 AM
To: Eran Hammer-Lahav; Marius Scurtescu; [e-mail]
Cc: OAuth WG
Subject: Re: [OAUTH-WG] Issue: Scope parameter

I don’t see how the presence of a scope parameter hurts interoperability.

It think scope needs to be a 1st class citizen in the spec, not an extension. Without it, a client cannot request access to a specific set of resources (whether its represented as a string, URI, or anything else). Does the group think it Is important for an Authorization Server to be able to make auth decisions based on requested resources?