3 ms·
> Your resources (aka content) ACL should not be in the scope itself I have to disagree on this one, being able to specify which resources an OAuth client can
by tehbeard 6y ago
> Your resources (aka content) ACL should not be in the scope itself
I have to disagree on this one, being able to specify which resources an OAuth client can tinker with is useful (e.g. only read access to x,y and z repos).
I'm also curious on how often these use cases are of needing many scopes / a god JWT, vs. production usage and keeping a narrow scope for the task at hand. There's also the other option (if in charge of authoring the resource server) to have broader scopes that encompass several others.
- user5994461 6y agoIn enterprise, one example is when active directory groups are put into the token. This makes sense because permissions are often managed by groups (read write, read only, user, admin, etc...), so employees can request a specific group to access some business application(s). This causes issues when an employee invariably has a hundred groups, adding multiple kilobytes to the token, more than is permitted by HTTP headers.
- tehbeard 6y agoAh, I haven't had the pleasure of dealing with enterprise AD that convoluted yet.