After reading OAuth spec couple of time, I am struggling to understand the relation between clients, owners and the scopes for all possible scenarios.
The scope it self is clear to me, but the relation is not.
For Authorization Code, Implicit and resource owner password credentials flows, resource owners credentials are involved (in one way or another). For my understanding, the scopes that are "granted" to client are the one the are "granted" to user, or less
depending if scope parameter is passed initially by the client and the content of the scope parameter in that case.
1. If this is true, than how to relate scope with client for client credentials flow?
2. I this is not true, than how the client access rights can be different for when different user (for the first 3 Oauth flows). Lets say that we have some client app which can be used by multiple different users with different privileges. So we want ...
Go to the complete details ...