OAuth 2.0授权框架中文版 [7] - 访问受保护资源

7. 访问受保护资源 - Accessing Protected Resources

客户端通过向资源服务器出示访问令牌来访问受保护资源。资源服务器必须检验该访问令牌，确保其未过期，且授权的scope可以访问当前请求的资源。资源服务器如何校验访问令牌超出了本规范要讨论的范围，但一般是通过与授权服务器之间进行交互协作来实现。

The client accesses protected resources by presenting the access
token to the resource server. The resource server MUST validate the
access token and ensure that it has not expired and that its scope
covers the requested resource. The methods used by the resource
server to validate the access token (as well as any error responses)
are beyond the scope of this specification but generally involve an
interaction or coordination between the resource server and the
authorization server.

客户端如何使用访问令牌与资源服务器进行认证，取决于授权服务器签发的访问令牌的类型。一般来说，会使用[RFC2617]中提及的HTTP的"Authorization"请求头，配合所使用的访问令牌类型的相关规范文档中定义的认证方案来协调实现，如[RFC6750]。

The method in which the client utilizes the access token to
authenticate with the resource server depends on the type of access
token issued by the authorization server. Typically, it involves
using the HTTP “Authorization” request header field [RFC2617] with an
authentication scheme defined by the specification of the access
token type used, such as [RFC6750].

7.1 访问令牌类型 - Access Token Types

访问令牌的类型能告知客户端如何成功使用访问令牌访问受保护资源，如果客户端不清楚访问令牌的类型，则不得使用该访问令牌。

The access token type provides the client with the information
required to successfully utilize the access token to make a protected
resource request (along with type-specific attributes). The client
MUST NOT use an access token if it does not understand the token
type.

比如，[RFC6750]中定义的bearer令牌类型，通过简单的将访问令牌包含到如下请求中进行使用：

GET /resource/1 HTTP/1.1
Host: example.com
Authorization: Bearer mF_9.B5f-4.1JqM

For example, the “bearer” token type defined in [RFC6750] is utilized
by simply including the access token string in the request:

 GET /resource/1 HTTP/1.1
 Host: example.com
 Authorization: Bearer mF_9.B5f-4.1JqM

当使用[OAuth-HTTP-MAC]中定义的mac令牌类型时，通过对HTTP请求中的主要组件进行签名（消息认证码），来与访问令牌配合使用：

GET /resource/1 HTTP/1.1
Host: example.com
Authorization: MAC id="h480djs93hd8",
                    nonce="274312:dj83hs9s",
                    mac="kDZvddkndxvhGRXZhvuDjEWhGeE="

while the “mac” token type defined in [OAuth-HTTP-MAC] is utilized by
issuing a Message Authentication Code (MAC) key together with the
access token that is used to sign certain components of the HTTP
requests:

 GET /resource/1 HTTP/1.1
 Host: example.com
 Authorization: MAC id="h480djs93hd8",
                    nonce="274312:dj83hs9s",
                    mac="kDZvddkndxvhGRXZhvuDjEWhGeE="

如上的仅作为示例，开发者在实际使用前，请参考[RFC6750]and[OAuth-HTTP-MAC]规范。

The above examples are provided for illustration purposes only.
Developers are advised to consult the [RFC6750] and [OAuth-HTTP-MAC]
specifications before use.

所有访问令牌类型的声明，都必须说明与access_token配合使用的额外的参数（如果有）。它同时也定义当访问受保护资源时，应该采用何种HTTP认证方式来携带访问令牌。

Each access token type definition specifies the additional attributes
(if any) sent to the client together with the “access_token” response
parameter. It also defines the HTTP authentication method used to
include the access token when making a protected resource request.

7.2 错误响应 - Error Response

如果资源访问失败，资源服务器应该告知客户端错误原因。这类错误的细节信息不在本规范的讨论范围内，但本文档在11.4章节还是为OAuth令牌认证方案的错误值建立了一个共享的注册表。

If a resource access request fails, the resource server SHOULD inform
the client of the error. While the specifics of such error responses
are beyond the scope of this specification, this document establishes
a common registry in Section 11.4 for error values to be shared among
OAuth token authentication schemes.

如果新的认证方案主要是为OAuth令牌认证方案设计的，那么应该定义一种向客户端提供错误状态码的机制，在该机制中，错误码应注册在本规范建立的共享注册表中。

New authentication schemes designed primarily for OAuth token
authentication SHOULD define a mechanism for providing an error
status code to the client, in which the error values allowed are
registered in the error registry established by this specification.

这类方案可以将有效的错误状态码设置为已注册项的子集。如果使用命名参数来返回错误码，参数名应该为error。

Such schemes MAY limit the set of valid error codes to a subset of
the registered values. If the error code is returned using a named
parameter, the parameter name SHOULD be “error”.

如果认证方案有能力作为OAuth令牌认证方案，但主要不是为此设计的，也可以用同样的方式将自己的错误码绑定到注册表中。

Other schemes capable of being used for OAuth token authentication,
but not primarily designed for that purpose, MAY bind their error
values to the registry in the same manner.

新的认证方案也可以选择使用error_description和error_uri参数，以与本规范中error参数平行的方式返回错误信息。

New authentication schemes MAY choose to also specify the use of the
“error_description” and “error_uri” parameters to return error
information in a manner parallel to their usage in this
specification.