Subject: Re: [OAUTH-WG] [oauth] Enterprise usage question: Role based access and scope parameter

From: Lukas Rosenstock <[email-masked]>
Date: Wed, 7 Jul 2010 09:38:52 +0200

"scope" is about the permissions that a client application is
requesting. But if those permissions are inherently bound to the users
becaus the users have certain roles, the Access Token requested for a
user can be bound to those roles by the Authorization server. I don't
feel there's a requirement to use "scope" at all.

If, however, you want client applications to specifically state for
which role they're requesting access, there's nothing to prevent you
from implementing the scheme suggested. The specification doesn't
state any format of scopes and neither does it say anything on how the
scope values are converted into actual access privileges.

Regards,
 Lukas Rosenstock

2010/7/6 wjgerritsen <[email-masked]>:
> Hi,
>
> I am playing with the idea of using role names in the scope parameter
> (of RequestToken endpoint) for authorizing to our platform. It will
> work somehow like this: A user has a number of roles: e.g. SalesRep,
> Employee, Manager. To each role a consistent privilege set is
> assigned, so the user would also be able to use (part of) the
> functionality of the platform with only one role.
>
> Then the token would be bound to a certain role (e.g. SalesRep), such
> that the consumer app cannot excercise all privileges of the user, but
> only those limited to the assigned scope, which is a role. Upon app
> registration, it will be made clear which roles are liable for the
> scope parameter.
>
> Any comments?
>
> regards,
> Willem Jan
>
> --
> You received this message because you are subscribed to the Google Groups "OAuth" group.
> To post to this group, send email to [email-masked].
> To unsubscribe from this group, send email to [email-masked].
> For more options, visit this group at http://groups.google.com/group/oauth?hl=en.
>
>