...

This is done by a chained token transfer. For this the Requester calls the Token Requester API on the Authorization Manager (AM) and the AM in turn calls the Token Requester API of the Host. The Host then returns a token (maybe with prior checks) to the AM which in turn is given to the Requester which then can perform the actual call with it.

Roles

The following roles are defined:

• Requester is performing authorized requests to a Host (in OAuth terms it's a client)
• Host is the component which hosts a resource which a Requester wants access to (in OAuth terms it's a server)
• Authorization Manager (AM) is the component in the middle which is capable of negotiating between Requesters and Hosts and which can give out tokens. It might also be the central point for managing terms and policies in the future.