How to get a new access token with additional scope without re-login?

Question

I am working with Cloudfoundry UAA

I am not sure if it is possible in standard oauth2. The situation is ->

1. User logs into the app
2. He receives an access_token and refresh_token
3. He can keep on acquiring new access_tokens which has original scopes
4. His access permission changes so new scopes are added for him

Now I need a new access token, without him to log in again. Is it possible that I can use the same refresh_token and ask for access_token with modified scopes?

Thanks in advance!

Answer 1

In a word no. This would be a violation of the user's Trust. And in case you have not heard, that is a bad thing.

There is an Internet Draft RFC OAuth 2.0 Incremental Authorization (put forth by Google) There is some talk about it here.