An OAuth scope is a named permission value that limits the access or identity information requested by a client. OpenID Connect standardizes values such as `openid` and `profile`, while OAuth 2 also permits application-specific names. section 13.4
Use scopes to make token purpose explicit:
- Assign distinct scopes when separating user-dependent grants from client-independent grants. section 14.3
- Choose names that reveal the permitted operation, such as `LIVENESS` for checking resource-server availability. section 14.3
Requesting a client-credentials scope
A client registers the `CUSTOM` scope, requests it with `grant_type=client_credentials`, and receives an access token whose response records `scope: CUSTOM`. section 14.3
Listing 14.8 Configuring a registered client for the client credentials grant type
@Bean
public RegisteredClientRepository registeredClientRepository() {
RegisteredClient registeredClient =
RegisteredClient.withId(UUID.randomUUID().toString())
.clientId("client")
.clientSecret("secret")
.clientAuthenticationMethod(
ClientAuthenticationMethod.CLIENT_SECRET_BASIC) #1
.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
.scope("CUSTOM") #2
.build();
return new InMemoryRegisteredClientRepository(registeredClient);
}
Shows the registered-client configuration that assigns a custom scope to the client-credentials grant. section 14.3
