Scalability and prior relationships between ASs and RSs

[Denisthemalice]

In OAuth: The token format is defined between a RS and an AS using out of bands means, hence a prior relationship must exist between every RS and every AS. This is not scalable.

In GNAP: A RS MUST trust access tokens delivered by some AS(s) for some kind of privileges present in these access tokens.
Note: Trust relationships are only unilateral.

In general, ASs do not need to have a prior knowledge of RSs, nor trust relationships with RSs.
This allows the model to be scalable over the Internet

However, in the case where an AS delivers capabilities (i.e. rights) on some objects on behalf of a RO,
that AS needs to have a trust relationship with that RO.

[fimbault]

Not sure what's your point here.

[Denisthemalice]

The text should clarify that two broad types of approaches are supported:

• one where an AS and a RS have no prior relationship, and
• another one where an AS and a RS have established a prior relationship (before an access token is being granted).

Note 1: In the case where an AS and a RS have no prior relationship, on-line means to negotiate the access token format
between a client and an AS and a RS must be used.

Note 2: In the case where where an AS and a RS have established a prior relationship, they may have agreed
(using out of bands means) the access token format to be used.

In addition, if rights may be included into access tokens issued by an AS for a RS, the RS must nominate (using out of bands means)
to the AS which RO(s) are able to deliver rights about some objects placed under the control of the RS .

[jricher]

GNAP core is agnostic to how the AS and RS establish their relationship. The GNAP-RS extension created by #246 describes some mechanisms by which this relationship can be established dynamically if desired.

[Denisthemalice]

This issue has been marked "Pending Close", however its content is important.

@jricher . You wrote:

GNAP core is agnostic to how the AS and RS establish their relationship.

This is not the topic of this thread. As an example, OAuth is mandating the AS and the RS to have a prior relationship.
However, "OAuth core is agnostic to how the AS and RS establish their relationship".

Token format negotiation is not needed when the AS and the RS have a prior relationship, but may be needed/useful
if they don't have such prior relationship.

Some text should be inserted into the current draft to capture this important difference.