Authorization Processing Method, Device, and System

An authorization device for authorizing a user to access a resource using a public client, comprising:

• a memory comprising a plurality of computer readable instructions;
• and
• a processor coupled to the memory, wherein the plurality of computer readable instructions cause the processor to be configured to:
• receive a first authorization request from the public client, wherein the first authorization request comprises a client identifier of the public client, a requested redirect uniform resource identifier (URI), and a first requested authorization scope;
• obtain authorization information of the public client according to the client identifier;
• obtain an authorization scope corresponding to an authorization credential of the user stored in the authorization information;
• and
• obtain authorization notification information of an owner of the resource according to the first requested authorization scope when the first requested authorization scope exceeds the authorization scope corresponding to the authorization credential of the user;
• generate, according to the first requested authorization scope and the authorization notification information, a first access token whose authorization scope corresponds to the first requested authorization scope;
• and
• send the first access token to the public client according to the requested redirect URI.

An authorization processing system, used to authorize a user to access a resource using a public client, comprising:

• the public client configured to:
• send a first authorization request to an authorization device, wherein the first authorization request comprises a client identifier of the public client, a requested redirect uniform resource identifier (URI), and a first requested authorization scope;
• and
• receive a first access token from the authorization device, and
• the authorization device configured to:
• receive the first authorization request from the public client;
• obtain authorization information of the public client according to the client identifier;
• obtain an authorization scope corresponding to an authorization credential of the user stored in the authorization information;
• obtain authorization notification information of an owner of the resource according to the first requested authorization scope when the first requested authorization scope exceeds the authorization scope corresponding to the authorization credential of the user;
• generate, according to the first requested authorization scope and the authorization notification information, the first access token whose authorization scope corresponds to the first requested authorization scope;
• and
• send the first access token to the public client according to the requested redirect URI.