Exam 350-901 topic 1 question 63 discussion

I think this should be the resource owner -> A https://cloud.google.com/apigee/docs/api-platform/security/oauth/oauth-introduction

The authorization server issues access tokens to the client after successfully authenticating the resource owner and obtaining authorization.

the resource owner consent doesn't grant permission.

The answer is A: https://www.ibm.com/docs/en/datapower-gateway/7.6?topic=flows-three-legged-oauth-flow

A: The resource owner is the entity (typically a user) who grants permission to access their resources. The client is the application requesting access to the resource. The authorization server issues tokens and handles the authorization process. The resource server hosts the protected resources. The authorization server facilitates the authorization process, but it is not the entity that grants access to the protected resource. Access is granted by the resource owner when they authorize the client to access their resources.

The correct answer is A. > The resource owner decides whether to grant the requested access to the client application.

A is the correct (B) In this step, the resource owner decides whether to grant the requested access to the client application.

it must be the resource owner (A)

"In this step, the resource owner decides whether to grant the requested access to the client application"

I've changed my mind! I think it's A now because it is actually the end user (the resource owner) who grants access for the app to get the data from the resource server.

It's not A because that is the end-user. It's not B as that is the app that needs the authz token. It could be C as this is the one actually sending the actual. I think it's D as the authz server __grants__ the access. The resource server sends the data.

D is correct, https://www.ibm.com/docs/en/datapower-gateways/2018.4?topic=flows-three-legged-oauth-flow

I don't agree. For me the solution is Ressource Server.