Subject: [OAUTH-WG] RAR - Client Credentials and Authorization Details

From: Matthew De Haast <[email-masked]>
Date: Thu, 14 May 2020 11:04:50 +0200

RFC6749 allows scopes to be presented at the token endpoint for cases like
client credentials grants.

It's not clear how this could be achieved with the current RAR spec though
when a Client using Client Credentials wants to request fine grained access
using authorization_details. Or should this even be possible?

Matt

---

From: Torsten Lodderstedt <[email-masked]>
Date: Thu, 14 May 2020 12:09:47 +0200

Sure. That's possible. 

https://tools.ietf.org/html/draft-ietf-oauth-rar-01#section-3.1 states 

"The request parameter can be used to specify authorization
   requirements in all places where the "scope" parameter is used for
   the same purpose, examples include:

…

Access token requests as specified in [RFC6749], if also used as
      authorization requests, e.g. in the case of assertion grant types
      [RFC7521]”

I filed a ticket to also mention this in the token request section. 

> On 14. May 2020, at 11:04, Matthew De Haast <matt=[email-masked]> wrote:
> 
> RFC6749 allows scopes to be presented at the token endpoint for cases like client credentials grants.
> 
> It's not clear how this could be achieved with the current RAR spec though when a Client using Client Credentials wants to request fine grained access using authorization_details. Or should this even be possible?
> 
> Matt
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth