Comments (3)
Thanks Daniel but to be honest a great coder and colleague of mine @mtornwall is the original author of that module. Anyway I think you're reading it backwards. You should think of it as A β B
such as {root, a} β {root, a, b}
. That is A is a subset with same or fewer elements than B for the function oauth2_priv_set:is_subset(A, B)
.
from oauth2.
Hi @drobakowski! This behavior is the result of a (perhaps unfortunate) design decision early on. Basically, when testing if A is a subset of B we check if all paths in A are also in B. In your first example the path root-a is indeed present in B. This has been the source of much confusion. The idea is that you shouldn't associate any privileges with non-leaf nodes, like root.a.
I am typing this up on my tablet so I had to be brief. If you have more questions I will try and answer them from a real computer. :)
from oauth2.
Hi @bipthelin, hi @mtornwall! Thanks for your quick and detailed response! The behavior and idea of priv_set
is now clear to me. My focus was to strong on our own privilege scenario, where we have to restrict the privileges only with leaf nodes and not to every possible path of the tree. With a set
in mind the methods is_subset/is_member
work as expected. :) For now we'll evaluate and work with our internal priv_set
implementation, thanks again for the detailed description!
from oauth2.
Related Issues (20)
- missing oauth2:authorize_password/3 with refresh token HOT 7
- Neither oauth2:issue_code_grant/3 nor /4 verify the scope HOT 1
- Add Context argument to all oauth2 and oauth2_backend API functions HOT 2
- Adding a test/sample of application-only-auth to twitter? HOT 1
- expires_in parameter is converted to a binary by oauth2_response:to_proplist/1 HOT 1
- Canβt refresh access tokens generated with Resource Owner Password Credentials Grant and oauth2:authorize_password/4 HOT 2
- Can't see how and why oauth2_backend:verify_resowner_scope/3 returns a client HOT 2
- Remove resource owner authentication HOT 1
- Remove get_redirection_uri not needed
- authorize_password/7
- Refresh token
- feature request: jwt support HOT 8
- Publish to hex.pm HOT 2
- Add link to cowboy_oatuh
- type map(_,_) undefined with Erlang 18 HOT 1
- Release request HOT 2
- 4.2.1. Authorization Request - client_secret is required? HOT 2
- token revocation by a user
- Update the upstream?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
π Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. πππ
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google β€οΈ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from oauth2.