How to specify audience for an OAuth2 access token?

oauth oauth-2.0 jwt access-token
Free Willaert picture Free Willaert · Aug 25, 2017 · Viewed 9.6k times · Source

I am confused that there seems to be no standard way to specify the audience for an access token when sending an authorization request to an authorization server.

OAuth2 specifies access tokens as opaque strings; there is only one mention of 'audience' in the spec, to say that access tokens could be 'audience-restricted'. Many recent authorization server implementations seem to produce JWT access tokens, and JWT specifies the audience (aud) claim.

As far as I find: - Auth0 uses an 'audience' parameter - Connect2id uses a 'resource' parameter - Identity Server uses a fixed issuer-based value for 'aud' claim, and assumes that scopes are enough - however, this does not fit all use cases. - The excellent 'OAuth2 in Action' book shows an example with a resource server URI in the 'aud' claim, but doesn't say where it comes from.

So, how to get an access token for a specific audience (resource server, API,...) in a standard way?

Answer

jwilleke picture jwilleke · Aug 25, 2017

I think you are right. There are a couple of guidelines available. The OAuth 2.0 Authorization Framework: Bearer Token Usage OAuth 2.0: Audience Information (draft-tschofenig-oauth-audience-00.txt)

OpenID connect a clear defined "aud" parameter as:

REQUIRED. Audience(s) that this ID Token is intended for. It MUST contain the OAuth 2.0 client_id of the Relying Party as an audience value. It MAY also contain identifiers for other audiences. In the general case, the aud value is an array of case sensitive strings. In the common special case when there is one audience, the aud value MAY be a single case sensitive string.

Related questions

What is the difference between OAuth based and Token based authentication?

I thought that OAuth is basically a token based authentication specification but most of the time frameworks act as if there is a difference between them. For example, as shown in the picture below Jhipster asks whether to use an …

Read More
May an OAuth 2.0 access token be a JWT?

From what I can tell, the OAuth 2.0 specification is extremely vague in terms of what form an access token should take: The token may denote an identifier used to retrieve the authorization information or may self-contain the authorization information in …

Read More
What are the main differences between JWT and OAuth authentication?

I have a new SPA with a stateless authentication model using JWT. I am often asked to refer OAuth for authentication flows like asking me to send 'Bearer tokens' for every request instead of a simple token header but I …

Read More