<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Does anyone have guidance on validity of the following scenario?:<br>
<blockquote>There is a Resource Server, RS-1, that, in order to
provide its service<br>
needs to also access a downstream Resource Server RS-2.<br>
<br>
When the oauth client requests an access token, it is granted an
access token<br>
by the az-svr (that knows that both RS-1 and RS-2 must be used)
that<br>
contains 2 audiences: RS-1 and RS-2.<br>
<br>
The oauth client uses the access token to access RS-1.<br>
<br>
RS-1, in turn, uses the same access token to access RS-2.<br>
<br>
The response is returned from RS-2 to RS-1.<br>
RS-1 combines the response from RS-2 w its own resp and<br>
returns the combined response to the oauth client.<br>
</blockquote>
Given that the token is a bearer token it seems to me there is no
reason why<br>
both the oauth client AND the RS-1 can't use the access token to get
what they<br>
need, w/o RS-1 having to register itself as a separate client and
get its own<br>
access token.<br>
<br>
So, the question is whether this is a legitimate use case for a
resource server<br>
to access downstream services.<br>
<br>
Thanks,<br>
Rich<br>
<br>
</body>
</html>