{"action":"created","issue":{"url":"https://api.github.com/repos/xmlgrrl/UMA-Specifications/issues/161","labels_url":"https://api.github.com/repos/xmlgrrl/UMA-Specifications/issues/161/labels{/name}","comments_url":"https://api.github.com/repos/xmlgrrl/UMA-Specifications/issues/161/comments","events_url":"https://api.github.com/repos/xmlgrrl/UMA-Specifications/issues/161/events","html_url":"https://github.com/xmlgrrl/UMA-Specifications/issues/161","id":95081915,"number":161,"title":"Protocol assumes one resource owner per URL","user":{"login":"jricher","id":122511,"avatar_url":"https://avatars.githubusercontent.com/u/122511?v=3","gravatar_id":"","url":"https://api.github.com/users/jricher","html_url":"https://github.com/jricher","followers_url":"https://api.github.com/users/jricher/followers","following_url":"https://api.github.com/users/jricher/following{/other_user}","gists_url":"https://api.github.com/users/jricher/gists{/gist_id}","starred_url":"https://api.github.com/users/jricher/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jricher/subscriptions","organizations_url":"https://api.github.com/users/jricher/orgs","repos_url":"https://api.github.com/users/jricher/repos","events_url":"https://api.github.com/users/jricher/events{/privacy}","received_events_url":"https://api.github.com/users/jricher/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-07-15T01:35:49Z","updated_at":"2015-07-16T16:42:49Z","closed_at":null,"body":"The UMA protocol assumes that each individual user at the resource server has a unique URL, but not every API is designed this way. In fact, many OAuth APIs use the OAuth token itself to provide context for the response from the protected resource. For instance, in OpenID Connect, the UserInfo Endpoint is a shared endpoint among all users at an IdP. The OAuth access token presented to the endpoint provides the server with enough information to determine which user profile to return in the response.\r\n\r\nAPI designers are vanishingly unlikely to change their APIs to accommodate the quirks of a security protocol."},"comment":{"url":"https://api.github.com/repos/xmlgrrl/UMA-Specifications/issues/comments/122016161","html_url":"https://github.com/xmlgrrl/UMA-Specifications/issues/161#issuecomment-122016161","issue_url":"https://api.github.com/repos/xmlgrrl/UMA-Specifications/issues/161","id":122016161,"user":{"login":"gffletch","id":751457,"avatar_url":"https://avatars.githubusercontent.com/u/751457?v=3","gravatar_id":"","url":"https://api.github.com/users/gffletch","html_url":"https://github.com/gffletch","followers_url":"https://api.github.com/users/gffletch/followers","following_url":"https://api.github.com/users/gffletch/following{/other_user}","gists_url":"https://api.github.com/users/gffletch/gists{/gist_id}","starred_url":"https://api.github.com/users/gffletch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gffletch/subscriptions","organizations_url":"https://api.github.com/users/gffletch/orgs","repos_url":"https://api.github.com/users/gffletch/repos","events_url":"https://api.github.com/users/gffletch/events{/privacy}","received_events_url":"https://api.github.com/users/gffletch/received_events","type":"User","site_admin":false},"created_at":"2015-07-16T16:42:49Z","updated_at":"2015-07-16T16:42:49Z","body":"Ahh.. I think I see your point. The RS could register the same URL with multiple Authorization Servers because it knows the PAT, but when a client is requesting that URL without an RPT, there is no way for the RS to know which AS it should send the Client to get authorization. "}}