Exam 350-901 topic 1 question 63 discussion

I think this should be the resource owner -> A https://cloud.google.com/apigee/docs/api-platform/security/oauth/oauth-introduction

the resource owner consent doesn't grant permission.

The answer is A: https://www.ibm.com/docs/en/datapower-gateway/7.6?topic=flows-three-legged-oauth-flow

A: The resource owner is the entity (typically a user) who grants permission to access their resources. The client is the application requesting access to the resource. The authorization server issues tokens and handles the authorization process. The resource server hosts the protected resources. The authorization server facilitates the authorization process, but it is not the entity that grants access to the protected resource. Access is granted by the resource owner when they authorize the client to access their resources.

The correct answer is A. > The resource owner decides whether to grant the requested access to the client application.

A is the correct (B) In this step, the resource owner decides whether to grant the requested access to the client application.

it must be the resource owner (A)

Cisco DEVCOR Study Guide 350-901 2022 edition, page 69, section 2.5, "Describe the steps in the OAuth2 three‐legged authorization code grant flow": (B) In this step, the resource owner decides whether to grant the requested access to the client application. In the case of Google, it would display a consent window that shows the name of the application, Google services that it is requesting access to, and a summary of the scopes of access to be granted. The user can then consent to grant access or refuse the request. I'll go with A

"In this step, the resource owner decides whether to grant the requested access to the client application"

I've changed my mind! I think it's A now because it is actually the end user (the resource owner) who grants access for the app to get the data from the resource server.

It's not A because that is the end-user. It's not B as that is the app that needs the authz token. It could be C as this is the one actually sending the actual. I think it's D as the authz server __grants__ the access. The resource server sends the data.

D is correct, https://www.ibm.com/docs/en/datapower-gateways/2018.4?topic=flows-three-legged-oauth-flow

I don't agree. For me the solution is Ressource Server.