Our system has users but we want to perhaps allow some users to be able to use our API service. I'm looking at using OAuth2 for authorization. As it's going to be (trusted) machine-to-machine access I also thought to use client credentials.
So, for example, when we create an article through our API we want it to have an author (user). So perhaps store access tokens, auth tokens, client credentials in the users collection for each user that is granted API access? Is this good practice?
Users collection:
[
{
"_id": MongoId("uguifdguioei..."),
"username": "joe.sixpack",
.
.
"oauth": {
"client_id": "1234567890",
"client_secret": "qwertyuiop1234567890",
"access_token": "8sf989dgd9fgdjkngf77y3retr8ghujker",
"refresh_token": "usknfgeor..."
}
},
.
.
.
]
In another (MySQL) project I have a bunch of additional tables (oauth_clients, oauth_scopes, oauth_access_tokens", etc) but I would rather avoid creating a bunch of new collections. Also, perhaps with mongo I can take advantage of nested data.
Also, attaching the oauth stuff to the user would mean we could perhaps rely upon our apps ACL for authorization (rather than scopes) and use the oauth storage for simply issueing and verifying auth codes, access tokens, refresh tokens etc.
I haven't started on development yet, just trying to figure out a clean way to handle the Oauth stuff. Would appreciate any feedback on this implementation, thanks