Auth: implement oauth endpoint selection by bolt about nuts-node HOT 4 CLOSED

The RFC is too vague on this point, needs clarification:

Each service MUST define an oauth serviceEndpoint. This endpoint is either the URL of the authorization server, or in case of a compound service an URI which resolves to another service. In order for the client to resolve the authorization server endpoint it MUST look up the auth service endpoint of the service.

• does "it MUST look up the auth service endpoint of the service." apply to the compound endpoints?
• is auth a typo which should've been oauth?

https://nuts-foundation.gitbook.io/drafts/rfc/rfc003-oauth2-authorization

from nuts-node.

maybe we should solve the service CRDT problem first, which might result in abandoning the service reference concept...

from nuts-node.

maybe we should solve the service CRDT problem first, which might result in abandoning the service reference concept...

services will be immutable, but still referenceable via URI query params. So RFC003 needs a clarification?

from nuts-node.

there's a bit more involved:

• create a bearer token => requires the oauth service id. There's support for scope <- use as bolt? Renaming to service might be better
• use vdr to resolve the service ID,
• create token
• The token is only useable at the url defined by the service ID. Now it's up to the user to use it. The service could return the URL/Service as return value next to the token.

from nuts-node.