Subject: [OAUTH-WG] authorization_details token request parameter and comparison in RAR

From: Torsten Lodderstedt <[email-masked]>
Date: Mon, 19 Apr 2021 18:20:56 +0200

Hi all,

in the recent RAR session, we started a discussion about an authorization_details token request parameter. 

This parameter would allow us to solve several outstanding topics: 
- Let the client determine what privileges to assign to the first access token issued in exchange for an authorisation code
- Downscoping privileges of pre-existing grant (code, refresh token, CIBA, device)
- Request access tokens with client credentials  

We also discussed the challenge of comparing requested and already granted authorization details and how this relates to the way application/API specific logic might be integrated into an AS.

In order to continue the discussion, we would like to share the following PR with you for discussion: 

https://github.com/oauthstuff/draft-oauth-rar/pull/66

It introduces the authorization_details token request parameter and gives examples of how comparison could be performed in this context. 

Please give us feedback on the PR to drive the discussion. 

best regards,
Torsten.