Frequently when updated a resource not only does the Calling Application need to be known, but the End User that is attempting to perform the update also needs to be known. Either one or both are needed to properly determine if the action is authorized, while both are needed for audit logging.
Authorize End User & App in Resource Server (Service)
As a Resource Service Developer, I need to be able to lookup permissions and enforce access authorization.
Status
colour
Green
title
must have
For application specific permissions, the Authorization Provider should be determined by the Resource Service Developer. This can be something created solely by the developer for their needs or it can be a campus provided solution.
Verify App in Resource Server (Service)
As a Resource Service Developer, I need to be able to provide the Resource service with authenticated identity information about the client application using my resource.
Below is a list of questions to be addressed as a result of this requirements document:
Question
Outcome
Decision Date
Can you use the Introspection Endpoint from the Resource Service? Is the original client_id and client_secret required? Or will it work with the client_id of the Resource Service (Registrations SVC ucsbNetId)?
What does the Introspection Endpoint return for the password grant type? Does it return both the End User ucsbNetId and the client_ID (Client App ucsbNetId)?
It returns both the sub (End User ucsbNetId) and the client_id (Client App ucsbNetId).
