Subject: [OAUTH-WG] RAR & multiple resources?

From: Dick Hardt <[email-masked]>
Date: Mon, 13 Jan 2020 17:31:31 -0800

Torsten / Justin / Brian

In my reading of the ID, it appears that there is a request for just one
access token, and the authorization_details array lists one or more
resources that the one access token will provide access to. Correct?

I have heard anecdotally that there is interest in granting access to
multiple resources, and having multiple access tokens, which would enable
different components of a client to have different access tokens.

Do you consider multiple access tokens out of scope of RAR?

/Dick

---

From: Mike Jones <[email-masked]>
Date: Tue, 14 Jan 2020 01:48:19 +0000

Please don’t use RAR as a pandora’s box to introduce unrelated new semantics, including issuing multiple access tokens.

                                                       -- Mike

From: OAuth <[email-masked]> On Behalf Of Dick Hardt
Sent: Monday, January 13, 2020 5:32 PM
To: Torsten Lodderstedt <[email-masked]>; Brian Campbell <[email-masked]>; Justin Richer <[email-masked]>
Cc: [email-masked]
Subject: [EXTERNAL] [OAUTH-WG] RAR & multiple resources?

Torsten / Justin / Brian

In my reading of the ID, it appears that there is a request for just one access token, and the authorization_details array lists one or more resources that the one access token will provide access to. Correct?

I have heard anecdotally that there is interest in granting access to multiple resources, and having multiple access tokens, which would enable different components of a client to have different access tokens.

/Dick

---

From: "Richard Backman, Annabelle" <[email-masked]>
Date: Tue, 14 Jan 2020 02:09:34 +0000

+1 to Mike’s comment. These are independent issues; one could use RAR with one access token or multiple access tokens, and one could use multiple access tokens with or without RAR.

–
Annabelle Richard Backman
AWS Identity

From: OAuth <[email-masked]> on behalf of Mike Jones <Michael.Jones=[email-masked]>
Date: Monday, January 13, 2020 at 5:49 PM
To: Dick Hardt <[email-masked]>, Torsten Lodderstedt <[email-masked]>, Brian Campbell <[email-masked]>, Justin Richer <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [OAUTH-WG] [EXTERNAL] RAR & multiple resources?

                                                       -- Mike

Torsten / Justin / Brian

/Dick

---

From: Justin Richer <[email-masked]>
Date: Mon, 13 Jan 2020 21:20:06 -0500

Multiple access tokens are outside the scope of RAR. The request is intended to describe the access for a single returned access token. If semantics for multiple access tokens are agreed upon, then it can use the RAR structure, the Resources parameter, and the Scope parameter all in parallel again.

 — Justin

> On Jan 13, 2020, at 8:31 PM, Dick Hardt <[email-masked]> wrote:
> 
> Torsten / Justin / Brian
>

---

From: Dick Hardt <[email-masked]>
Date: Mon, 13 Jan 2020 21:08:44 -0800

That’s what I thought. Thanks for the clarification.

On Mon, Jan 13, 2020 at 6:20 PM Justin Richer <[email-masked]> wrote:

> Multiple access tokens are outside the scope of RAR. The request is
> intended to describe the access for a single returned access token. If
> semantics for multiple access tokens are agreed upon, then it can use the
> RAR structure, the Resources parameter, and the Scope parameter all in
> parallel again.
>
>  — Justin
>