Change scope while issuing new access token when client sends valid refresh token

3
votes

I am using php oauth2 library from this github repo.

PHP oauth2 library

Whenever i send a refresh token, I receive new access token with old scopes. But i want to change the scopes returned with new access token.

When i first generate a token using user credentials grant type, I get the supported scopes for the user and store them this way.

$defaultScope = implode(" ", $scopes);$memory = new OAuth2\Storage\Memory(array('default_scope' =>$defaultScope));
$scopeUtil = new OAuth2\Scope($memory);
$this->server->setScopeUtil($scopeUtil);
$this->server->handleTokenRequest(OAuth2\Request::createFromGlobals())->send();

where $scopes is an array

for example $scopes=array("ADDUSER","EDITUSER","EDITROLE");

similarly , if i send refresh token using refresh_token grant type and run this with modified $scopes for example $scopes=array("ADDUSER", "EDITROLE");

  $defaultScope = implode(" ", $scopes);$memory = new OAuth2\Storage\Memory(array('default_scope' =>$defaultScope));
$scopeUtil = new OAuth2\Scope($memory);
$this->server->setScopeUtil($scopeUtil);
$this->server->handleTokenRequest(OAuth2\Request::createFromGlobals())->send();

I receive same old scopes("ADDUSER EDITUSER EDITROLE") which were set when new access token generated using user credentials grant type.

SO is there a way to change scopes when new access token is generated using refresh token ? or am i doing something wrong here?

1
phpoauthoauth-2.0
but user agreed on different scopes while /authorize phase. Seems you are trying to do something against specification ; ) – hi_my_name_is
trying to implement users and roles using oauth. i need this feature because, if the role itself modified then scope for user with dat role changes. – Krish Gowda
but scope is set per application, not per user. This way you would have to use different app for everyone. User by accepting scopes give app ability to do something on user behalf. You can fetch roles from oauth2 provider, but its different thing than scope and would have to be managed in other place. – hi_my_name_is

1 Answers

0
votes

A Client can "down-scope" when it asks for a new access token in the refresh token grant, see the documentation around scope in the spec here: https://tools.ietf.org/html/rfc6749#section-6 Yet your Authorization server may or may not support that.