{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2015","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer3","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2015/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2015/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2015/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/2015","id":110996731,"number":2015,"title":"IdToken vs AccessToken sent to Resource Server","user":{"login":"danutzplusplus","id":10243023,"avatar_url":"https://avatars.githubusercontent.com/u/10243023?v=3","gravatar_id":"","url":"https://api.github.com/users/danutzplusplus","html_url":"https://github.com/danutzplusplus","followers_url":"https://api.github.com/users/danutzplusplus/followers","following_url":"https://api.github.com/users/danutzplusplus/following{/other_user}","gists_url":"https://api.github.com/users/danutzplusplus/gists{/gist_id}","starred_url":"https://api.github.com/users/danutzplusplus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danutzplusplus/subscriptions","organizations_url":"https://api.github.com/users/danutzplusplus/orgs","repos_url":"https://api.github.com/users/danutzplusplus/repos","events_url":"https://api.github.com/users/danutzplusplus/events{/privacy}","received_events_url":"https://api.github.com/users/danutzplusplus/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/labels/question","name":"question","color":"cc317c"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":18,"created_at":"2015-10-12T15:20:00Z","updated_at":"2016-08-31T20:34:29Z","closed_at":"2015-10-27T06:50:08Z","body":"Hello, I've something that I would like to ask someone for some clarification. It's not an issue with IdentityServer V3, but something more general, about the usage of tokens of different types.\r\n\r\nConsidering we have the two different types of tokens, identity and access, which one is used for what scenario? Would there be any issue with sending an identity token to a resource server, like a WebAPI service.\r\n\r\nFrom what I understood, from all the reading and research I did, the identity token is specifically targeted for the client application (for establishing current user identity in the client application), and the client will then ask a different token/s, an access one, for calling the resource server which will hand over information to the client application. \r\n\r\nAnd more specifically, the identity token contains certain fields that allows the client application to establish user identity and also establish that the token was indeed intended for itself (by checking the audience on the token; something that the access token does not necesarily have (I'm a bit confused here, since the JWT token issued by the Thinktecture IdServer does populate the audience field with a issuer_uri/resources value))\r\n\r\nAnd the access tokens, which come with requested scopes, offer an authorization mechanism at the client level. So, in the end, for me at least, idtokens are for the client app, and access tokens are for the resource servers (webapis, ...). Is there any reason to send an id token to a resource server, or the other way around? Are there any issues with that? Any security considerations?\r\n\r\nThanks, and kind regards.\r\n\r\n<!---\r\n@huboard:{\"custom_state\":\"archived\"}\r\n-->\r\n"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/comments/243892384","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/2015#issuecomment-243892384","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2015","id":243892384,"user":{"login":"brockallen","id":649492,"avatar_url":"https://avatars.githubusercontent.com/u/649492?v=3","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false},"created_at":"2016-08-31T20:34:29Z","updated_at":"2016-08-31T20:34:29Z","body":"https://identityserver.github.io/Documentation/docsv2/configuration/scopesAndClaims.html"}}
{"actor":{"display_login":"brockallen"}}