Authorization Server and Authorization Agent

[elf-pavlik]

I'd like to discuss some approaches related to those use cases

• 2.5.2. Limiting application access while not acting as resource controller
• 2.6.1. Delegating subset of received access to another agent

Diagrams below use the following terminology:

• RO - Resource Owner
• EU - End-user
• AS - Authorization Server
• AA - Authorization Agent
• RS - Resource Server

The first one showcases a typical OAuth2 scenario, where:

• Resource Owner = End-user
• Resource Owner stays associated with Authorization Server
• End-user gets redirected to Authorization Server associated Resource Owner
• Resource Serve stays associated with Authorization Server
• Client gets authorized by RO/EU at AS
• Client uses the access token issued by AS when making requests to Resource Server

The second one showcases a typical scenario in Solid, where:

• Resouce Owner ≠ End-user
• Resource Owner stays associated with Authorization Agent (here same as AS associated with their storage)
• Resource Owner issues Source Grant to End-user (RO's AA notifies EU's AA)
• End-user stays associated with Authorization Agent (different than one associated with RO)
• End-user gets redirected to Authorization agent associated with them
• Client gets App Grant from EU's AA
• Client exchanges App Grant with AS associated with RS

While keeping the same as the in the first one:

• Resource Serve stays associated with Authorization Server
• Client gets authorized by RO/EU at AS
• Client uses the access token issued by AS when making requests to Resource Server

The third one showcases an extended delegation scenario. It's similar to the second with additional:

• Resource Owner issues Source Grant to another User
• that User issues Delegated Grant to End-user
• that User's AA notifies RO's AA about delegation