Subject: [OAUTH-WG] Scopes in access token response

From: Andreas Kohn <[email-masked]>
Date: Tue, 3 Dec 2013 12:55:58 +0100

Hi,

the current RFC for OAuth 2.0 (http://www.rfc-editor.org/rfc/rfc6749.txt)
is very unclear on *how* to return the scope in the access token response
if there are multiple scopes requested/returned.

Could someone please clarify whether the scopes are supposed to be returned
as
1. space separated string value (i.e. in the same syntax in which they came
in), or
2. as JSON array (looks most "JSON-y"), or
3. in another format (for example github uses ',')

There is a related question on stackoverflow:
http://stackoverflow.com/questions/13290994/how-should-approved-scopes-be-returned-from-an-oauth2-0

Regards,
--
Andreas

---

From: Thomas Broyer <[email-masked]>
Date: Tue, 3 Dec 2013 13:43:25 +0100

I think it's very clear, on the opposite. Section 5.1 defers to section 3.3
which says very clearly that the value is a space-delimited list.

---

From: Lewis Adam-CAL022 <[email-masked]>
Date: Wed, 4 Dec 2013 19:37:01 +0000

I believe the question was asking about how the scope is returned in the access token.  Section 5.1/3.3 are really describing how the scope is *requested*

Andreas …. The answer to your question is that it is out of scope for the OAuth RFC.  OAuth does not define the structure of the access token, so it will be implementation specific.  Many implementations pass an unstructured access token which is sent back to the AS for introspection, and returned a JSON set of claims including the scope.  Others use JWT-structured access tokens.  Do you have a specific implementation that you are asking about, or was it simply a generic question?

adam

From: OAuth [mailto:[email-masked]] On Behalf Of Thomas Broyer
Sent: Tuesday, December 03, 2013 6:43 AM
To: Andreas Kohn
Cc: <[email-masked]>
Subject: Re: [OAUTH-WG] Scopes in access token response

Le 3 déc. 2013 12:56, "Andreas Kohn" <[email-masked]<mailto:[email-masked]>> a écrit :
>
> Hi,
>
> the current RFC for OAuth 2.0 (http://www.rfc-editor.org/rfc/rfc6749.txt) is very unclear on *how* to return the scope in the access token response if there are multiple scopes requested/returned.

I think it's very clear, on the opposite. Section 5.1 defers to section 3.3 which says very clearly that the value is a space-delimited list.

---

From: Justin Richer <[email-masked]>
Date: Wed, 4 Dec 2013 14:49:09 -0500

Actually, section 5.1 is quite specifically how it's returned, and the 
intent of the cross-reference to 3.3 is that they use the same format: a 
space-separated list presented as a single JSON string. The grammar in 
section A.4 applies to both.

  -- Justin

On 12/04/2013 02:37 PM, Lewis Adam-CAL022 wrote:
>
> I believe the question was asking about how the scope is returned in 
> the access token.  Section 5.1/3.3 are really describing how the scope 
> is **requested**
>
> Andreas .... The answer to your question is that it is out of scope 
> for the OAuth RFC.  OAuth does not define the structure of the access 
> token, so it will be implementation specific. Many implementations 
> pass an unstructured access token which is sent back to the AS for 
> introspection, and returned a JSON set of claims including the scope.  
> Others use JWT-structured access tokens.  Do you have a specific 
> implementation that you are asking about, or was it simply a generic 
> question?
>
> adam
>
> *From:*OAuth [mailto:[email-masked]] *On Behalf Of *Thomas Broyer
> *Sent:* Tuesday, December 03, 2013 6:43 AM
> *To:* Andreas Kohn
> *Cc:* <[email-masked]>
> *Subject:* Re: [OAUTH-WG] Scopes in access token response
>
>
> Le 3 déc. 2013 12:56, "Andreas Kohn" <[email-masked] 
> <mailto:[email-masked]>> a écrit :
> >
> > Hi,
> >
> > the current RFC for OAuth 2.0 
> (http://www.rfc-editor.org/rfc/rfc6749.txt) is very unclear on *how* 
> to return the scope in the access token response if there are multiple 
> scopes requested/returned.
>
> I think it's very clear, on the opposite. Section 5.1 defers to 
> section 3.3 which says very clearly that the value is a 
> space-delimited list.
>
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Lewis Adam-CAL022 <[email-masked]>
Date: Wed, 4 Dec 2013 20:05:37 +0000

I stand corrected.  Thanks Justin :-)

And of course that makes perfect sense since the AT is typically opaque to the client, yet the client would need to know if it obtained the requested scope.

From: Justin Richer [mailto:[email-masked]]
Sent: Wednesday, December 04, 2013 1:49 PM
To: Lewis Adam-CAL022; Thomas Broyer; Andreas Kohn
Cc: <[email-masked]>
Subject: Re: [OAUTH-WG] Scopes in access token response

Actually, section 5.1 is quite specifically how it's returned, and the intent of the cross-reference to 3.3 is that they use the same format: a space-separated list presented as a single JSON string. The grammar in section A.4 applies to both.

 -- Justin

Andreas .... The answer to your question is that it is out of scope for the OAuth RFC.  OAuth does not define the structure of the access token, so it will be implementation specific.  Many implementations pass an unstructured access token which is sent back to the AS for introspection, and returned a JSON set of claims including the scope.  Others use JWT-structured access tokens.  Do you have a specific implementation that you are asking about, or was it simply a generic question?

adam

From: OAuth [mailto:[email-masked]] On Behalf Of Thomas Broyer
Sent: Tuesday, December 03, 2013 6:43 AM
To: Andreas Kohn
Cc: <[email-masked]><mailto:[email-masked]>
Subject: Re: [OAUTH-WG] Scopes in access token response

OAuth mailing list

[email-masked]<mailto:[email-masked]>

---

From: John Bradley <[email-masked]>
Date: Wed, 4 Dec 2013 17:06:39 -0300

Per Sec 3.3 and Appendix A.4

scope is a space SP separated list of scope-token which are 1*NQCHAR 

So query encoded it looks like &scope=openid%20profile%20email (you would be sending it in a POST form encoded to the token endpoint in your case) 
and the response will be JSON:
{
   "access_token":"2YotnFZFEjr1zCsicMWpAA",
   "token_type":"example",
   "expires_in":3600,
   "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
   "scope":"openid profile email"
 }

Yes the examples probably should have included scope but it is clear from the normative text.

John B.

On Dec 3, 2013, at 8:55 AM, Andreas Kohn <[email-masked]> wrote:

> Could someone please clarify whether the scopes are supposed to be returned as 
> 1. space separated string value (i.e. in the same syntax in which they came in), or 
> There is a related question on stackoverflow: http://stackoverflow.com/questions/13290994/how-should-approved-scopes-be-returned-from-an-oauth2-0
> 
> 
> Regards,
> --
> Andreas
> 
> 
>

---

From: Pat Patterson <[email-masked]>
Date: Wed, 4 Dec 2013 16:01:54 -0800

For what it's worth, we pass back a space-separated list in the response:

{
  "id":"
https://login.salesforce.com/id/00Dd0000000f6kcEAA/005d0000001kTmOAAU",
  "issued_at":"1386201559129",
  *"scope":"id api refresh_token",*
  "instance_url":"https://aloha.my.salesforce.com",
  "refresh_token":"5Ae...vDy",
  "signature":"5cN...mw=",
  "access_token":"00D...1aI"
}

Cheers,

Pat

-- 

Pat Patterson | Developer Evangelist Architect |
http://about.me/patpatterson

On Wed, Dec 4, 2013 at 12:06 PM, John Bradley <[email-masked]> wrote:

> So query encoded it looks like &scope=openid%20profile%20email (you would
> be sending it in a POST form encoded to the token endpoint in your case)

---

From: Torsten Lodderstedt <[email-masked]>
Date: Thu, 05 Dec 2013 07:07:13 +0100

Hi Pat,

out of couriosity: what is the meaning of the "refresh_token" scope value?

regards,
Torsten.

Pat Patterson <[email-masked]> schrieb:
>> Yes the examples probably should have included scope but it is clear
>from
>> the normative text.
>>
>> John B.
>>
>(http://www.rfc-editor.org/rfc/rfc6749.txt)
>> > 1. space separated string value (i.e. in the same syntax in which
>they
>> came in), or
>------------------------------------------------------------------------
>

---

From: Pat Patterson <[email-masked]>
Date: Thu, 5 Dec 2013 13:24:21 -0800

It means 'issue me (the client app) with a refresh token' - see
https://help.salesforce.com/apex/HTViewHelpDoc?id=remoteaccess_oauth_scopes.htm&language=enand
https://help.salesforce.com/apex/HTViewHelpDoc?id=remoteaccess_oauth_refresh_token_flow.htm&language=en

Cheers,

Pat

-- 

On Wed, Dec 4, 2013 at 10:07 PM, Torsten Lodderstedt <
[email-masked]> wrote:

>>> So query encoded it looks like &scope=openid%20profile%20email (you
>>> would be sending it in a POST form encoded to the token endpoint in your
>>> case)
>>> from the normative text.
>>> > the current RFC for OAuth 2.0 (
>>> http://www.rfc-editor.org/rfc/rfc6749.txt) is very unclear on *how* to
>>> return the scope in the access token response if there are multiple scopes
>>> requested/returned.
>>> >
>> ------------------------------
>>
>> OAuth mailing list
>> [email-masked]

---

From: "Andreas Kohn" <[email-masked]>
Date: Thu, 05 Dec 2013 13:43:53 -0800 (PST)

Hi, 

Thank you all for your answers. 

I was asking mainly because I'm considering to use scopes for implementing versioning in our API, and so was expecting to request multiple scopes (each representing a known (subset of) the API), and check the response which scopes have been made available to the client. 

Best regards,

--

Andreas

---

From: Torsten Lodderstedt <[email-masked]>
Date: Sun, 08 Dec 2013 17:05:37 +0100

Hi Pat,

sounds reasonable for the scope parameter of the access token request. 
As your example is an access token response, I would expect the scope 
parameter to contain the scope values associated with the access token.

regards,
Torsten.

Am 05.12.2013 22:24, schrieb Pat Patterson:
> On Wed, Dec 4, 2013 at 10:07 PM, Torsten Lodderstedt 
> <[email-masked] <mailto:[email-masked]>> wrote:
>
>     Hi Pat,
>
>     Pat Patterson <[email-masked]
>     <mailto:[email-masked]>> schrieb:
>
>         "id":"https://login.salesforce.com/id/00Dd0000000f6kcEAA/005d0000001kTmOAAU",
>         On Wed, Dec 4, 2013 at 12:06 PM, John Bradley
>         <[email-masked] <mailto:[email-masked]>> wrote:
>
>             So query encoded it looks like
>             &scope=openid%20profile%20email (you would be sending it
>             in a POST form encoded to the token endpoint in your case)
>             On Dec 3, 2013, at 8:55 AM, Andreas Kohn
>             <[email-masked] <mailto:[email-masked]>>
>             wrote:
>
>             > Hi,
>             >
>             (http://www.rfc-editor.org/rfc/rfc6749.txt) is very
>             unclear on *how* to return the scope in the access token
>             response if there are multiple scopes requested/returned.
>             >
>             > [email-masked] <mailto:[email-masked]>
>             [email-masked] <mailto:[email-masked]>
>         [email-masked]  <mailto:[email-masked]>