@@ -23,10 +23,10 @@ func ScopesToRules(scopes []string, namespace string, clusterPolicyGetter ruleva

 	for _, scope := range scopes {

 		found := false

-		for prefix, evaluator := range scopeEvaluators {

-			if strings.HasPrefix(scope, prefix) {

+		for _, evaluator := range ScopeEvaluators {

+			if evaluator.Handles(scope) {

 				found = true

-				currRules, err := evaluator(scope, namespace, clusterPolicyGetter)

+				currRules, err := evaluator.ResolveRules(scope, namespace, clusterPolicyGetter)

 				if err != nil {

 					errors = append(errors, err)

 					continue

@@ -51,13 +51,17 @@ const (

 	NamespaceWideIndicator = "namespace:"

 )

-// scopeEvaluator takes a scope and returns the rules that express it

-type scopeEvaluator func(scope, namespace string, clusterPolicyGetter rulevalidation.ClusterPolicyGetter) ([]authorizationapi.PolicyRule, error)

+// ScopeEvaluator takes a scope and returns the rules that express it

+type ScopeEvaluator interface {

+	Handles(scope string) bool

+	Validate(scope string) error

+	ResolveRules(scope, namespace string, clusterPolicyGetter rulevalidation.ClusterPolicyGetter) ([]authorizationapi.PolicyRule, error)

+}

-// scopeEvaluators map prefixes to a function that handles that prefix

-var scopeEvaluators = map[string]scopeEvaluator{

-	UserIndicator:        userEvaluator,

-	ClusterRoleIndicator: clusterRoleEvaluator,

+// ScopeEvaluators map prefixes to a function that handles that prefix

+var ScopeEvaluators = []ScopeEvaluator{

+	userEvaluator{},

+	clusterRoleEvaluator{},

 }

 // scopes are in the format

@@ -75,7 +79,23 @@ const (

 )

 // user:<scope name>

-func userEvaluator(scope, namespace string, clusterPolicyGetter rulevalidation.ClusterPolicyGetter) ([]authorizationapi.PolicyRule, error) {

+type userEvaluator struct{}

+

+func (userEvaluator) Handles(scope string) bool {

+	return strings.HasPrefix(scope, UserIndicator)

+}

+

+func (userEvaluator) Validate(scope string) error {

+	switch scope {

+	case UserIndicator + UserInfo,

+		UserIndicator + UserAccessCheck:

+		return nil

+	}

+

+	return fmt.Errorf("unrecognized scope: %v", scope)

+}

+

+func (userEvaluator) ResolveRules(scope, namespace string, clusterPolicyGetter rulevalidation.ClusterPolicyGetter) ([]authorizationapi.PolicyRule, error) {

 	switch scope {

 	case UserIndicator + UserInfo:

 		return []authorizationapi.PolicyRule{

@@ -91,7 +111,31 @@ func userEvaluator(scope, namespace string, clusterPolicyGetter rulevalidation.C

 }

 // role:<clusterrole name>:<namespace to allow the cluster role, * means all>

-func clusterRoleEvaluator(scope, namespace string, clusterPolicyGetter rulevalidation.ClusterPolicyGetter) ([]authorizationapi.PolicyRule, error) {

+type clusterRoleEvaluator struct{}

+

+func (clusterRoleEvaluator) Handles(scope string) bool {

+	return strings.HasPrefix(scope, ClusterRoleIndicator)

+}

+

+func (e clusterRoleEvaluator) Validate(scope string) error {

+	if !e.Handles(scope) {

+		return fmt.Errorf("bad format for scope %v", scope)

+	}

+	tokens := strings.SplitN(scope, ":", 2)

+	if len(tokens) != 2 {

+		return fmt.Errorf("bad format for scope %v", scope)

+	}

+

+	// namespaces can't have colons, but roles can.  pick last.

+	lastColonIndex := strings.LastIndex(tokens[1], ":")

+	if lastColonIndex <= 0 || lastColonIndex == (len(tokens[1])-1) {

+		return fmt.Errorf("bad format for scope %v", scope)

+	}

+

+	return nil

+}

+

+func (clusterRoleEvaluator) ResolveRules(scope, namespace string, clusterPolicyGetter rulevalidation.ClusterPolicyGetter) ([]authorizationapi.PolicyRule, error) {

 	tokens := strings.SplitN(scope, ":", 2)

 	if len(tokens) != 2 {

 		return nil, fmt.Errorf("bad format for scope %v", scope)

@@ -9,6 +9,7 @@ import (

 	"k8s.io/kubernetes/pkg/util/validation/field"

 	oapi "github.com/openshift/origin/pkg/api"

+	authorizerscopes "github.com/openshift/origin/pkg/authorization/authorizer/scope"

 	"github.com/openshift/origin/pkg/oauth/api"

 	uservalidation "github.com/openshift/origin/pkg/user/api/validation"

 )

@@ -53,6 +54,7 @@ func ValidateAccessToken(accessToken *api.OAuthAccessToken) field.ErrorList {

 	allErrs := validation.ValidateObjectMeta(&accessToken.ObjectMeta, false, ValidateTokenName, field.NewPath("metadata"))

 	allErrs = append(allErrs, ValidateClientNameField(accessToken.ClientName, field.NewPath("clientName"))...)

 	allErrs = append(allErrs, ValidateUserNameField(accessToken.UserName, field.NewPath("userName"))...)

+	allErrs = append(allErrs, ValidateScopes(accessToken.Scopes, field.NewPath("scopes"))...)

 	if len(accessToken.UserUID) == 0 {

 		allErrs = append(allErrs, field.Required(field.NewPath("userUID"), ""))

@@ -68,6 +70,7 @@ func ValidateAuthorizeToken(authorizeToken *api.OAuthAuthorizeToken) field.Error

 	allErrs := validation.ValidateObjectMeta(&authorizeToken.ObjectMeta, false, ValidateTokenName, field.NewPath("metadata"))

 	allErrs = append(allErrs, ValidateClientNameField(authorizeToken.ClientName, field.NewPath("clientName"))...)

 	allErrs = append(allErrs, ValidateUserNameField(authorizeToken.UserName, field.NewPath("userName"))...)

+	allErrs = append(allErrs, ValidateScopes(authorizeToken.Scopes, field.NewPath("scopes"))...)

 	if len(authorizeToken.UserUID) == 0 {

 		allErrs = append(allErrs, field.Required(field.NewPath("userUID"), ""))

@@ -132,6 +135,7 @@ func ValidateClientAuthorization(clientAuthorization *api.OAuthClientAuthorizati

 	allErrs = append(allErrs, ValidateClientNameField(clientAuthorization.ClientName, field.NewPath("clientName"))...)

 	allErrs = append(allErrs, ValidateUserNameField(clientAuthorization.UserName, field.NewPath("userName"))...)

+	allErrs = append(allErrs, ValidateScopes(clientAuthorization.Scopes, field.NewPath("scopes"))...)

 	if len(clientAuthorization.UserUID) == 0 {

 		allErrs = append(allErrs, field.Required(field.NewPath("useruid"), ""))

@@ -175,3 +179,45 @@ func ValidateUserNameField(value string, fldPath *field.Path) field.ErrorList {

 	}

 	return field.ErrorList{}

 }

+

+func ValidateScopes(scopes []string, fldPath *field.Path) field.ErrorList {

+	allErrs := field.ErrorList{}

+

+	for i, scope := range scopes {

+		illegalCharacter := false

+		// https://tools.ietf.org/html/rfc6749#section-3.3 (full list of allowed chars is %x21 / %x23-5B / %x5D-7E)

+		// for those without an ascii table, that's `!`, `#-[`, `]-~` inclusive.

+		for _, ch := range scope {

+			switch {

+			case ch == rune("!"[0]):

+			case ch >= rune("#"[0]) && ch <= rune("]"[0]):

+			case ch >= rune("]"[0]) && ch <= rune("~"[0]):

+			default:

+				allErrs = append(allErrs, field.Invalid(fldPath.Index(i), scope, fmt.Sprintf("%v not allowed", ch)))

+				illegalCharacter = true

+			}

+		}

+		if illegalCharacter {

+			continue

+		}

+

+		found := false

+		for _, evaluator := range authorizerscopes.ScopeEvaluators {

+			if !evaluator.Handles(scope) {

+				continue

+			}

+

+			found = true

+			if err := evaluator.Validate(scope); err != nil {

+				allErrs = append(allErrs, field.Invalid(fldPath.Index(i), scope, err.Error()))

+				break

+			}

+		}

+

+		if !found {

+			allErrs = append(allErrs, field.Invalid(fldPath.Index(i), scope, "no scope handler found"))

+		}

+	}

+

+	return allErrs

+}

@@ -131,6 +131,28 @@ func TestValidateClientAuthorization(t *testing.T) {

 			T: field.ErrorTypeForbidden,

 			F: "metadata.namespace",

 		},

+		"no scope handler": {

+			A: oapi.OAuthClientAuthorization{

+				ObjectMeta: api.ObjectMeta{Name: "myusername:myclientname"},

+				ClientName: "myclientname",

+				UserName:   "myusername",

+				UserUID:    "myuseruid",

+				Scopes:     []string{"invalid"},

+			},

+			T: field.ErrorTypeInvalid,

+			F: "scopes[0]",

+		},

+		"bad scope": {

+			A: oapi.OAuthClientAuthorization{

+				ObjectMeta: api.ObjectMeta{Name: "myusername:myclientname"},

+				ClientName: "myclientname",

+				UserName:   "myusername",

+				UserUID:    "myuseruid",

+				Scopes:     []string{"user:dne"},

+			},

+			T: field.ErrorTypeInvalid,

+			F: "scopes[0]",

+		},

 	}

 	for k, v := range errorCases {

 		errs := ValidateClientAuthorization(&v.A)

@@ -225,6 +247,28 @@ func TestValidateAccessTokens(t *testing.T) {

 			T: field.ErrorTypeForbidden,

 			F: "metadata.namespace",

 		},

+		"no scope handler": {

+			Token: oapi.OAuthAccessToken{

+				ObjectMeta: api.ObjectMeta{Name: "accessTokenNameWithMinimumLength"},

+				ClientName: "myclient",

+				UserName:   "myusername",

+				UserUID:    "myuseruid",

+				Scopes:     []string{"invalid"},

+			},

+			T: field.ErrorTypeInvalid,

+			F: "scopes[0]",

+		},

+		"bad scope": {

+			Token: oapi.OAuthAccessToken{

+				ObjectMeta: api.ObjectMeta{Name: "accessTokenNameWithMinimumLength"},

+				ClientName: "myclient",

+				UserName:   "myusername",

+				UserUID:    "myuseruid",

+				Scopes:     []string{"user:dne"},

+			},

+			T: field.ErrorTypeInvalid,

+			F: "scopes[0]",

+		},

 	}

 	for k, v := range errorCases {

 		errs := ValidateAccessToken(&v.Token)

@@ -249,6 +293,7 @@ func TestValidateAuthorizeTokens(t *testing.T) {

 		ClientName: "myclient",

 		UserName:   "myusername",

 		UserUID:    "myuseruid",

+		Scopes:     []string{`user:info`},

 	})

 	if len(errs) != 0 {

 		t.Errorf("expected success: %v", errs)

@@ -305,6 +350,39 @@ func TestValidateAuthorizeTokens(t *testing.T) {

 			T: field.ErrorTypeForbidden,

 			F: "metadata.namespace",

 		},

+		"no scope handler": {

+			Token: oapi.OAuthAuthorizeToken{

+				ObjectMeta: api.ObjectMeta{Name: "authorizeTokenNameWithMinimumLength"},

+				ClientName: "myclient",

+				UserName:   "myusername",

+				UserUID:    "myuseruid",

+				Scopes:     []string{"invalid"},

+			},

+			T: field.ErrorTypeInvalid,

+			F: "scopes[0]",

+		},

+		"bad scope": {

+			Token: oapi.OAuthAuthorizeToken{

+				ObjectMeta: api.ObjectMeta{Name: "authorizeTokenNameWithMinimumLength"},

+				ClientName: "myclient",

+				UserName:   "myusername",

+				UserUID:    "myuseruid",

+				Scopes:     []string{"user:dne"},

+			},

+			T: field.ErrorTypeInvalid,

+			F: "scopes[0]",

+		},

+		"illegal character": {

+			Token: oapi.OAuthAuthorizeToken{

+				ObjectMeta: api.ObjectMeta{Name: "authorizeTokenNameWithMinimumLength"},

+				ClientName: "myclient",

+				UserName:   "myusername",

+				UserUID:    "myuseruid",

+				Scopes:     []string{`role:asdf":foo`},

+			},

+			T: field.ErrorTypeInvalid,

+			F: "scopes[0]",

+		},

 	}

 	for k, v := range errorCases {

 		errs := ValidateAuthorizeToken(&v.Token)

@@ -141,7 +141,7 @@ func TestOAuthStorage(t *testing.T) {

 	config := &oauth2.Config{

 		ClientID:     "test",

 		ClientSecret: "",

-		Scopes:       []string{"a_scope"},

+		Scopes:       []string{"user:info"},

 		RedirectURL:  assertServer.URL + "/assert",

 		Endpoint: oauth2.Endpoint{

 			AuthURL:  server.URL + "/authorize",