OIDC scenario with multiple resource servers

[Cantor, Scott]

> I've looked in the OPTokenAudience and OPAuthorization
> documentation pages, but I don't see how this is done. Is there a
> different document that explains how to setup this sort of
> behavior, or do I just need to read these two and figure it out? 

The resource parameter comes from the client (App1), not from the configuration (we don't have a means of defaulting it right now).

*Alllowing* it is a function of the client's metadata (the allowed audiences for its tokens) and may then also require registering and authorizing App2 as a token audience, but that depends on exactly what it ends up doing with the token. Much of it works fine with no direct knowledge of the resource server at all, which is advantageous IMHO.

The client credentials grant topic talks about it to some extent.

-- Scott