I'm designing an app architecture using OAuth 2.0. I have a separate Resource Server and Authorization Server. The latter keeps a database of users and the scopes available to them.
Now, my question is: How and where to store/model fine-grained, per-resource permissions?
I'm talking about a scenario similar to what happens in a file sharing app, say Dropbox, where user can choose which files to share with which other users. How to model this in context of OAuth?
Notably, in my case some users may exist purely in the Authorization Server database (the Resource Server doesn't know about them at all). Let's call them "read-only users"; in AS they would have access to a scope of
read_files_shared_to_me. And thus, that scope is the grant/token that my Client App displays to the Resource Server when asking for a particular resource (file). Now, how should I track which files are shared to which users, in the framework of OAuth (2.0)?
- If it is responsibility of the Resource Server, then how should it store the list of "allowed" users, if the users exist only in Authorization Server? Should the RS use the "token introspection endpoint" of AS to drill down what particular user is asking, and store a list of "allowed users" per resource ("ACL")?
- If it is responsibility of Authorization Server, then how should it pass the information about "resources available to this user" to the RS? From what I understand, "scopes" are rather general, they correspond to "roles/groups", not concrete fine-grained resources, so putting a list of resource IDs in a "scope" field of Authorization Grant / Access Token doesn't seem OK?
1 After some further research, I found a 2011 thread with similar question on [oauth-wg] mailing list. Some answers there suggest looking at "UMA". Unfortunately, the links seem to be either bit-rotten, or too vague. The apparent main page of UMA seems huge and still unclear to me. Also it's not clear to me if it's still relevant and up-to-date in 2018. Googling further on UMA I couldn't find helpful results. If "use UMA" is what you'd like to write as an answer, please try to explain a bit more on how I should apply it. Also, do you know of any concrete services using UMA for this purpose?