I am in the process of building out a private REST API. This API is intended for machine to machine communication. In short someone else's server will kick off a job via CRON that pulls information from my REST API.
Reading through the OAuth2 RFC6749 I concluded my clients will be a confidential client since they can keep their credentials secret(on the server). In addition, since this is invoked through CRON or some other scheduling process, I actually have no end user. Based on the two statements I believe client_credential is the most appropriate.
Some more details on what I am after. I have users setup as follows.
[Group]
/ | \
A B C - Users
In the example above users A, B, and C are part of some organization. They would like to pull information for their reporting team out of my platform. Technically, the information being pulled is owned by the group and not any individual user. Reading through RFC 7591 I believe the most appropriate solution is to allow members to generate client_id and client_secrets by dynamically registering a client for their organization. On my end, I would set up the client with the OAuth authorization server and the appropriate auth policy (scopes, lifetime, and claims).
My question. Is this appropriate use of client credentials grant type? Or am I bending it to fit my need and is there a more appropriate path?
