I have a confusion. So, in OAuth2.0 there are 4 types of Grant (Authorization Code, Password, Client Credentials and Implicit). In my use case, I have two login scenario. The first one is using username and password. In this case it's clear that I should use Password grant type to give access and refresh token to the user after they send username and password to the auth server.
In the second scenario, I have users logging in by using OAuth Provider like Google, Facebook, Github, etc. In this situation, once the user grant the permission to my application, I will exchange the authorization code with the access token and use this access token later to get the user info like username, email address, etc. My question is, once I get this user info, which grant type that I should use to return access token from my application auth server so that the user has access to their resources in my application?
In this situation, :
- I might only have their email address, but password. So, it's not possible to use password grant type.
- client credentials is also not possible because clientID and clientSecret used in this grant type usually belong to a platform like mobile app, web, or any other type of third party application.
any comment will be much appreciated! Thanks