OAuthv2 access tokens and resource servers

Question

In the OAuthv2 authorization grant, a “client app” authenticates itself against an “auth server”, and receives an “access token” for accessing resources living on a “resource server”.

My concerns:

• How does the resource server know that the access token is valid (not forged or expired)? Is there some underlying background communication between resource server and auth server?
• How does the resource server know the scope of the access token (read or write)? For instance, maybe when the client app was authorized, the user only authorized it for READ ONLY, but now the client app is trying to modify resources. How does the resource server protect against this?
• Obviously in the real world there needs to be more fine-grained roles/scopes other than just READ and WRITE. For instance a web service might need to allow WRITEs to certain users/client, but only for certain resources, or resources under the right conditions. How do the built-in OAuthv2 scopes get mapped to app-specific roles/permissions?

Answer 1

1) The Resource Server has to check back with the Authorization Server to make sure the token is still valid. This usually involves making a request and getting a response back.

2) One of the properties of an OAuth2 access token is the scope that it got when the Authorization Server granted it. So usually when the Resource Server checks, the Authorization Server will include the scope in the response.

3) The OAuth2 spec doesn't specify scopes, so they can be whatever you like. For example, the Open Id Connect specification does name a bunch of specific scopes: ["phone", "offline_access", "address", "email", "openid", "user", "profile"]. These scopes have specific meaning in Open ID Connect, but aren't named in the OAuth2 spec.

If you wanted to define scopes READ, WRITE, TRANSMUTE, PERCOLATE, FINDLE, SPLINE, or whatever, you could do that. The meaning and implementation of those scopes is up to you. Some could be very general, like READ and WRITE, but maybe PERCOLATE has a meaning that's very specific to your Resource Server.