0

I could use some feedback on designing a solution for handling two OAuth flows in a single request.

I have an API that currently supports OAuth2.0 (for users).

It was requested that we should be able to shut down access to the API for a given client (eg. mobile app) - amongst other things. The initial suggestion was to implement a simple APIKEY that could be revoked, but since I already have another API that is accessed using the client credential flow (CCF) I suggested using CCF for this as well. This would have some benefits like managing the clients, build in claims/roles and more.

However the problem then arises: How does a client communicate both the users AUTH token AND the clints own AUTH token?

I am not looking for a workaround (I have a few at hand already), but rather need an official way to do this - or an explanation of why I should not.

Improve this question
6
  • "shut down access to the API for a given client (eg. mobile app)" Do you mean shut down all mobile apps that user your service? Or do you mean a specific installation of the app on a specific device for a specific user? Or something in between?
    – John Wu
    May 2, 2022 at 23:06
  • A central part of OAuth is the authentication token. Many implementations use JWT (jwt.io) as the token, which has normal expiration claims. That can be checked server side if the token is still valid. You have a few options with token management. One is to simply have a short token life and have the client renegotiate for a new token relatively often. Or you can actively send out a revocation message to any services that check that OAuth token.
    – Berin Loritsch
    May 3, 2022 at 2:16
  • @JohnWu Through the client token i want/should to be able to shut down one entire client (mobile app) - or reconfigure that clients claims to disable specific rights. Through the user token it should be possible to also shut down individual users.
    – Martin Nielsen
    May 3, 2022 at 7:15
  • @BerinLoritsch yes, i know. The issue / question is about being able to authenticate two "things" in a single request: The application (authenticated using clinent credential flow) and the user logging in using a "standard" OAuth flow. When the API endpoint is hit, i would like it to be able to identify both the person AND the application that user is performing the action through.
    – Martin Nielsen
    May 3, 2022 at 7:18
  • Maybe I'm not understanding. You can't really authenticate a client per se. Even if you issued a client certificate with a private key, there is nothing to prevent a user from copying it to another device. You could maybe provide a mechanism for a user to download a token that is bound to a device's fingerprint and IP address. But at that point all we're talking about is a session. What am I missing?
    – John Wu
    May 3, 2022 at 8:11

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.