Subject: [OAUTH-WG] a question on authorization to resource and scope in request

From: [email-masked]
Date: Fri, 10 Aug 2012 14:53:15 +0800

Hi, all
   I wonder how an access token is bound with the required resource item, 
I cann't see any field specifying the requested resource  in request for 
authorization token and access token.
Is "scope" relevant with this?

Regards~~~

-Sujing Zhou

---

From: Håvard Geithus <[email-masked]>
Date: Fri, 10 Aug 2012 09:50:33 +0200

Hi,

Either the resource server can ask the authentication server for
information associated with the token (e.g. resource owner's id and scope)
or this information can be encrypted into the token string. The scope
defines what resources, and resource owner id defines whose resource. At
least that's how I *think* it is.

On Fri, Aug 10, 2012 at 8:53 AM, <[email-masked]> wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: Håvard Geithus <[email-masked]>
Date: Fri, 10 Aug 2012 09:52:26 +0200

Replace "authentication server" with "authorization server" in the previous
message ;)