Can't see how and why oauth2_backend:verify_resowner_scope/3 returns a client

[IvanMartinez]

Hello all,
I can't understand the change made here to verify_resowner_scope's result:
511fc9c
How can the function return a client from a resource owner and a scope?. And what is the point of doing so?. Apparently it has to be the same client as the one returned by get_client_identity/2 in oauth2:authorize_code_request/6. How is this supposed to work?.
Thank you,
Ivan

[drobakowski]

Hi @IvanMartinez,

this change was introduced to solve a problem that occurred while using oauth2:authorize_password/4 (not oauth2:authorize_code_request/6) and afterwards trying to use oauth2:refresh_access_token/2. For more details please see #38. I also don’t see a way how the client can be obtained directly from the resource owner and scope. It should be obtained from your backend context maybe through a mapping resource owner -> client and depend on your implementation. How do you verify if the scope is valid for the resource owner, couldn’t you also use this context for a resource owner -> client mapping? An maybe not so "clean" alternative could also be the AppCtx?

Greets,
David

[IvanMartinez]

Hello David,
The spec is not obvious about this, but I understand (specially from points 1.5 and 6) that only confidential (authenticated) clients can get refresh tokens. So if oauth2:authorize_password/4 is used no refresh token must be issued and oauth2:refresh_access_token/2 won't be used. Issuing refresh tokens to public clients doesn't look secure to me and raises many issues, as we can see here.
Greetings,
Ivan