search

zendframework / zend-expressive-authentication-oauth2

OAuth2 (server) authentication middleware for PSR-7 applications.
BSD 3-Clause "New" or "Revised" License
35 stars 20 forks source link

Scopes table makes little sense. #27

Open wshafer opened 6 years ago

wshafer commented 6 years ago

As scopes are not really attached to anything, this table doesn't make much sense. It doesn't look like I can attach scopes to users or clients, so all we have is a table of valid scope names which doesn't do a whole lot for us.

I suggest we either do away with scopes, or allow scopes to be added to clients/users

sheridans commented 6 years ago

I certainly don't think we should do away with scopes they are an integral part, and think they should be linked to both clients and users when implemented properly.

For example a scope of read-user-profile could be requested by a client, which would then be stored by the client along with the refresh token and user id. The user profile could then be requested by that particular client via the refresh token at any time.

A really good example of scope implementation can be found here which is done by CCP Games whereby third party clients can request access to certain in-game character info once the user has logged in and granted them the required scopes.

weierophinney commented 4 years ago

This repository has been closed and moved to mezzio/mezzio-authentication-oauth2; a new issue has been opened at https://github.com/mezzio/mezzio-authentication-oauth2/issues/4.