Consider adopting OAuth Rich Authorization Request

[RalphBragg]

The requirement to facilitate data sharing arrangements that go beyond identity information is vital to see adoption in “open banking” or “data sharing” ecosystem.

All banks in the U.K, Australia and New Zealand support OpenID financial grade api profile to share identity tokens and support data sharing between RPs and OPs. The document mentions this problem but doesn’t protest a solution. Can elements of the rich authorisation request be adopted to support granular data sharing arrangements.

[cbiesinger]

I am not sure I understand rich authorization but I think this can likely be addressed using the continuation API (#477) together with the fact that tokens are just opaque strings to the browser and can thus contain anything you want.