authentication - Can an OAuth 2.0 access token be used to authenticate a user in another context? -


i want know if permissible pass user's oauth 2.0 access token between applications , use method of logging them in.

i have iphone application uses password grant authenticate user, , uses access token future requests. iphone application able open our website in tab, , want user logged in our website when tab opens.

under oauth 2.0 spec, permissible pass token web request , have the web server authenticate , log user in request?

for example, browser might open following location (but use header, instead of query string):

https://example.com/account?access_token=foo_bar 

alternatively, dedicated endpoint oauth authentication , redirect used.

so in effect, question in 2 parts; can oauth 2.0 token shared between application contexts , can token used authenticate user in context?

in oauth 2.0 spec (rfc 6749), there couple of areas may relevant. client can receive access_token accepted multiple resource_servers if client comprised of multiple components different security contexts, should register each 1 , use different token:

single token across multiple resource servers

a single authorization server may issue access tokens accepted multiple resource servers. 

single client multiple components

a client may implemented distributed set of components, each different client type , security context (e.g., distributed client both confidential server-based component , public browser-based component).  if authorization server not provide support such clients or not provide guidance regard registration, client should register each component separate client. 

Comments