Can a user have two valid tokens at a time in oauth 2.0 for an authorization type grant type?

Question

* I have a simple question related to the oauth token, so my requirement is that the user can have several scopes A and B, and he created a token for him, but later he needs areas A and B, and his previous token valid therefore in this case

• Should I update the scope of an existing token?
• Should we generate a new token for a new area?
• Or do you need to create several tokens for one user?

Answer 1

If you want to update the scope of an existing token, and if your authorization server provides a mechanism for this, just do it. Essentially, a specific authorization server implementation provides a web API for updating areas of existing access tokens ( /auth/token/update API, /auth/client/authorization/update API).

Whether access tokens are available or not depends on each implementation of the authorization server. For example, if the implementation type of the access token is "self-sufficient" (for example, JWT ), the access tokens are not changed. On the other hand, if the type is "random string" (in this case, the actual data is stored in the database behind the authorization server), access tokens can be modified. See “7.1. Presenting the access token” in “ Full-fledged OAuth and OpenID Connect Talking On Findings ” for details.

In some implementations of the authorization server, several access tokens are issued for one combination of user and client application, while other implementations issue only one access token for this combination. A specific authorization server implementation provides a configuration flag that allows you to select any of the behaviors, as shown below. See also this answer .

Which approach you should take depends on your use case. Find the authorization server implementation that is best for your use.

Answer 2

OAuth2 access current cannot be changed, so you should get a new access token with a different set of areas. Access agents are generated for the application, and not for the user, but yes, there can be multiple access tokens allowed by one user - the user allows the application to perform some operations (areas) on his behalf.