Search code examples
oauth-2.0microservicescloudfoundry-uaa

How to get a new access token with additional scope without re-login?

I am working with Cloudfoundry UAA

I am not sure if it is possible in standard oauth2. The situation is ->

  1. User logs into the app
  2. He receives an access_token and refresh_token
  3. He can keep on acquiring new access_tokens which has original scopes
  4. His access permission changes so new scopes are added for him

Now I need a new access token, without him to log in again. Is it possible that I can use the same refresh_token and ask for access_token with modified scopes?

Thanks in advance!

Solution

  • In a word no. This would be a violation of the user's Trust. And in case you have not heard, that is a bad thing.

    There is an Internet Draft RFC OAuth 2.0 Incremental Authorization (put forth by Google) There is some talk about it here.