I'm just getting into OAuth2 and I'm a tad confused (you've probably heard that before)!
I am writing a small independent service which will expose a basic REST API enabling client applications to upload and download files. Please don't ask why I'm not using S3 or some other cloud provider service - suffice to say that the decision is out of my hands!
The service will just lump files into a flat storage space and leave it up to the client applications to structure the information if required. The service will therefore handle 'clients' with many 'files'.
Initially, this service will only be used by an old monolithic legacy web app - a classic 3 tier client-server architecture using J2EE and Apache Wicket for the front end (so server generated UI). There are dedicated instances of this web application running within third-party data centres as well as a few instances running in our own data centre. All of these will access the new service so not all communication will be within the same data center (all over HTTPS though).
Some instances of the legacy web-app are multi-tenant so within one such instance, not all tenants will have access to the new service.
At some point, there will also be a dedicated administration interface (in order to create new clients and assign storage quotas etc.) which will be a JS-SPA and will call admin REST endpoints.
So I'm having trouble figuring out which OAuth flow to implement. Implicit Flow seems appropriate for the JS Administration interface but as for the legacy app (and any future services/applications) I'm not really sure.