Hi Paul,
In the use case I was considering the PEP had its own OAuth token to enable it
to call the PDP, which it puts in the Authorization header, as usual.
The, PEP, however, is processing a request from some other subject, and there
is more info on that subject in the OAuth token that came in w the Request.
So, the PEP is sending its own OAuth token w the request, and putting the
user's oauth token in the XACML request, as one big attribute. However, as
Mohammad suggested it is better that the PEP extract the attrs from the
token rather than expecting the PDP to process it. Technically, it probably
could be made to work somehow, but it would be a very custom solution.
 Thanks,
 Rich
On 11/5/2018 2:12 PM, Paul Patrick wrote:
