[CXF-6663] Scope based authorization support for OAuth2 RS endpoints

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.1.5, 3.2.0
• Component/s: JAX-RS Security
• Estimated Complexity: Unknown
• Assignee: Sergey Beryozkin
• Reporter: Sergey Beryozkin
• Created: 04/Nov/15 14:15
• Updated: 14/Oct/16 14:19
• Resolved: 11/Nov/15 13:50

Description

Annotations like @ConfidentialClient, @Scopes("a", "b") should be used in the combinations or separately, ex, this method can only be invoked if the client behind this access token is confidential, and/or this client has 'a' and 'b' scopes approved. OAuth2 filter can already do some fine-grained authorization (restrict to specific HTTP verbs or URI subsets) and the RS code can use OauthContext to manually check the scopes, the client type, etc, but the annotation-based AC would be quite handy too