(Edited the subject line and will break up this thread into two for
clarity...)
Excellent point about "single authorization server", thanks, Justin!
The other thing I was wondering about was: Everyone okay if we excise the
other *n* instances of this explanation in the next section? As noted
during our last call, now that the "normative commentary" about interfaces
has largely moved to Section 1, I'd like to ensure that the messaging
specifics are cleanly spelled out in the next section, with no holes and no
"digressions" -- only xrefs back if we really want them.
*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl
On Thu, Dec 8, 2016 at 10:03 AM, Justin Richer
For my action item from Eve’s post, I would suggest this wording:
Note: In step 3, the client attempts access to a protected resource with no token, and in step 4, the resource server requests permissions on behalf of that client at the authorization server. In order for the resource server to know which authorization server to approach and which PAT (representing a resource owner) and resource identifier to supply in that request, the API being accessed by the client needs be structured in such a way that the resource server can derive this information from the client's token-free access attempt. Commonly, this information can be passed through the URI, headers, or body of the client's request. Alternatively, the entire interface could be dedicated to the use of a single resource owner and protected by a single authorization server.
— Justin