Re: Allowing an authorization server to provide an updated scope for OAuth2 tokens

2012-01-17 Thread Michael Matthews
----------| > |----> > | Subject: | > |> >> >> > >> -| > |Allowing an authorization server

Re: Allowing an authorization server to provide an updated scope for OAuth2 tokens

2012-01-14 Thread Matthew G Marum
| |> | Subject: | |> >-------------------------| |Allowing an authorizatio

Allowing an authorization server to provide an updated scope for OAuth2 tokens

2012-01-13 Thread Michael Matthews
Section 3.3 [1] of the OAuth2 spec suggests that an authorization server may issue an access token with a scope different than what was requested. It goes on to say that the authorization server SHOULD include a "scope" response parameter to inform the client of the actual scope granted. We'd lik