Uma-tarians, Here at Gluu we've been trying to come up with some options for API access management that leverage our UMA capabilities, while reducing the number of steps associated with the permission ticket flow. We came up with three options: 1) Eagerly issue an RPT token with permissions for resource sets where all scopes are satisfied. 2) Create a new token which just has the expiration and a list of scopes. Something like: { "active": true, "exp": 1256953732, "iat": 1256912345, "permissions": ["view", "manage" ] } And then the RS can evaluate if these scopes are sufficient for access. Maybe this token can be called the EAT (eager access token) or the GST (Granted Scope Token). 3) The RS takes the token above, and uses the OAuth2 token exchange endpoint, (see draft: https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-03 ) to swap out for a real RPT that specifies the scopes, or returns a permission ticket as normal if the scopes aren't suffcient. #1 has scale problems... especially if the AS has resource sets registered by RS's in many domains. It seems only appropriate for very small deployments in a single domain. #2 has minimal overlap with UMA. #3, I guess you have to wonder if it is really much better than the permission ticket flow. It moves complexity to the client, and in a best case, saves two steps (obtaining permission ticket, returning permission ticket). - Mike ------------------------------------- Michael Schwartz Gluu Founder / CEO mike@gluu.org