I have a quick questions
In your opinion, it makes sense to implement OAuth2 if all clients will be accessing their information via a trusted application?
My use case:
I have a mobile application, web application, and desktop application, all-consuming data from a 2 micro-services exposing a REST interface.
I want to secure them first at the application level, with authentication and authorization based on the users role. The application can consume data without any limitation but I want the users to be limited by their roles and permissions.
I implemented an authentication server using OAuth2 that authenticates the user and returns a token and user details(role and permissions) with
password grand_type, and as an application, I'm using
client_credentials grant_type. which they can use to access my resource server. And it's working fine
But now I really want to know if this should be the right approach for my use case, having in consideration that OAuth2 is more for access delegation
What are your thoughts on this
there is a simple and yet secure approach ? or Oauth2 totally fine?