...
We ARE meeting next week, but Friday at 9am PT, not Thursday. That's right after the Legal call.
Work on UMA.next issues
Syntax changes as listed above are confirmed OK. The new invalid_scope error is OK. We don't have to say "protected resource" all the time, particularly in syntax.
Eve is concerned that not being able to fully replace the permissions structure in the token introspection response is a bridge too far in having removed the token profile scaffolding. OAuth has token profiling. There is a use case for just conveying RqP identity claims for achieving fine-grained authorization at the edge (along with a use case for conveying RqP identity claims on top of permissions). UMA permissions on their own only convey "scope-grained" permissions. Can we reuse the UMA profiling capability to allow third parties to replace the permissions structure if they need to? It's already possible to create these (so Gluu could consider doing this).
...