[
https://issues.apache.org/jira/browse/CXF-6288?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14356881#comment-14356881
]
pavan commented on CXF-6288:
----------------------------
Here is my requirement:
In our system the protected resources will be associated with oauth2 scopes.
Each scope is in turn associates with set of roles means scope will only be
granted when logged in end user has the specified roles.
When the client application is registered with the OAuth2 server the
application can specify what are the scopes required for it (In CXF we can set
them through
[setRegisteredScopes|http://cxf.apache.org/javadoc/latest-3.0.x/org/apache/cxf/rs/security/oauth2/common/Client.html#setRegisteredScopes(java.util.List)]
method on client bean).
When end user sends an authorization request to the oAuth server cxf checks
what are scopes applicable and filters out invalid scopes (or raises an error).
After cxf populates the list of scopes ([After this
method|http://grepcode.com/file/repo1.maven.org/maven2/org.apache.cxf/cxf-rt-rs-security-oauth2/2.7.6/org/apache/cxf/rs/security/oauth2/utils/OAuthUtils.java#OAuthUtils.getRequestedScopes%28org.apache.cxf.rs.security.oauth2.common.Client%2Cjava.lang.String%2Cboolean%29])
i should get the list of roles applicable for those scopes from my database
and need to check against user roles. If any of the scope is not satisfying the
role requirement i should remove those scopes from the granted scopes.
Thanks,
Pavan.
> OAuth2: Hook to Pre-process or post process the scopes to have more control
> over Authorization
> ----------------------------------------------------------------------------------------------
>
> Key: CXF-6288
> URL: https://issues.apache.org/jira/browse/CXF-6288
> Project: CXF
> Issue Type: New Feature
> Components: JAX-RS Security
> Reporter: pavan
> Priority: Critical
>
> We have a requirement as such to grant scopes to the end user based on user
> roles. With the current cxf implementation we cant implement such
> requirement. It will be possible if CXF provide us with a hook which will
> enable the developers to process the scopes and return the resultant scopes.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
