Subject: [OAUTH-WG] Question on scope when refreshing an access token

From: Brian Campbell <[email-masked]>
Date: Tue, 29 Mar 2011 16:31:46 -0600

I'm a bit confused by the text at the end of the definition of the
scope parameter in section 6 on Refreshing an Access Token[1].  It
says,

        "...  The requested scope MUST be equal or lesser
         than the scope originally granted by the resource owner, and if
         omitted is treated as equal to the previously approved scope."

In particular, what is the 'previously approved scope'?  Is it the
same as the originally granted scope?  Or is it the most recent scope
successfully requested when refreshing? If the latter, does this imply
that an AS implementation must store both the original scope and the
previously requested scope? Or is it something else?

Perhaps a better question is what is the use case behind this text?  I
assume it's some kind of down-scoping (& I apologize if this has been
discussed before and I missed it) but the intent isn't clear to me nor is
it clear what exactly is required by the spec.

Thanks for any info,
Brian

[1] link to draft 13:
http://tools.ietf.org/html/draft-ietf-oauth-v2-13#section-6 and the
most recent preview of 14 has the same text.

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 29 Mar 2011 16:16:02 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Brian Campbell
> Sent: Tuesday, March 29, 2011 3:32 PM
> To: oauth
> Subject: [OAUTH-WG] Question on scope when refreshing an access token
> 
> I'm a bit confused by the text at the end of the definition of the scope
> parameter in section 6 on Refreshing an Access Token[1].  It says,
> 
> In particular, what is the 'previously approved scope'?  Is it the same as the
> originally granted scope?  Or is it the most recent scope successfully
> requested when refreshing? If the latter, does this imply that an AS
> implementation must store both the original scope and the previously
> requested scope? Or is it something else?
> 
> Perhaps a better question is what is the use case behind this text?  I assume
> it's some kind of down-scoping (& I apologize if this has been discussed
> before and I missed it) but the intent isn't clear to me nor is it clear what
> exactly is required by the spec.

Yep, just down-scoping. It is there to make sure that whatever the resource owner approved is always the most permissive scope granted. Do I need to make it clearer?

EHL

---

From: Brian Campbell <[email-masked]>
Date: Wed, 30 Mar 2011 07:00:04 -0600

Yeah, maybe it could be clarified a bit. Thanks. It made sense when I
first read the text. However, when I went to implement it, I started
reading into "previously approved" (maybe too much) and I think maybe
that wording is potentially ambiguous.

On Tue, Mar 29, 2011 at 5:16 PM, Eran Hammer-Lahav <[email-masked]> wrote:
>
>
> Yep, just down-scoping. It is there to make sure that whatever the resource owner
> approved is always the most permissive scope granted. Do I need to make it clearer?