Scopes and permissions with RBAC for Machine-to-machine authentication

[dan.woda]

Hi @tommyr,

I apologize for the delay.

Permissions and RBAC are user-centric. This is explained better here:

What is the difference between scopes and permissions?

Question: What is the difference between scopes and permissions? Answer: What are scopes? From the OAuth2 spec: The authorization and token endpoints allow the client to specify the scope of the access request using the “scope” request parameter. In turn, the authorization server uses the “scope” response parameter to inform the client of the scope of the access token issued. The value of the scope parameter is expressed as a list of space- delimited, case-sensitive strings. The str…

This would explain the difference in how they are treated in a SPA where a user is requesting an access token and a M2M app where there is no user.

Hope this helps in some way!
Dan