<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:10.0pt;
font-family:"Aptos",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">> </span><span style="font-size:11.0pt;color:black;background:white">App1 would include a resource parameter with its request so that the access token issued to App1 will be usable to access App2 on behalf
of the user.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black;background:white"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black;background:white">So this is the part that I don't understand, but something I'm fairly certain I want to do.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black;background:white"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black;background:white">I've looked in the OPTokenAudience and OPAuthorization documentation pages, but I don't see how this is done. Is there a different document that explains how to setup this sort
of behavior, or do I just need to read these two and figure it out?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black;background:white"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black;background:white">- Steve</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div id="mail-editor-reference-message-container">
<div>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">Cantor, Scott <cantor.2@osu.edu><br>
<b>Date: </b>Tuesday, June 17, 2025 at 8:57</span><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:black"> </span><span style="font-size:12.0pt;color:black">AM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Cc: </b>Mak, Steven <makst@upenn.edu><br>
<b>Subject: </b>Re: OIDC scenario with multiple resource servers<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt">> My question is mostly: Is sharing an OIDC secret a bad idea?<br>
<br>
It's not intended certainly.<br>
<br>
You don’t have multiple resource servers here. An OIDC RP is not really a resource server, that's an OAuth concept for a system you want to access from an OAuth client (the RP in this case, App1).<br>
<br>
> How should this be done? Is this a "two-legged" scenario? <br>
<br>
Depends if you count the browser, but it's four-legged essentially, it's the original OAuth use case (what was called three-legged) but adding an authorization server into the mix instead of App2 issuing its own tokens.<br>
<br>
App1 would include a resource parameter with its request so that the access token issued to App1 will be usable to access App2 on behalf of the user.<br>
<br>
Using a JWT access token lets it carry custom claims about the user to communicate that to App2 without the user actually interacting with it at all or it needing access to the UserInfo endpoint, which it would not have. App2 could also introspect the token
in lieu of using JWT format though.<br>
<br>
-- Scott<br>
<br>
<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>