Questions tagged [oauth2]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
3answers
124 views

Securing API for third party use

We have a set of microservices and would like to expose endpoints from a subset of these for third parties to use. To this end, we will build an API Gateway that acts as the access control mechanism ...
1
vote
1answer
51 views

What is the point of the OAuth2 client identifier?

The entire explanation of the client ID from RFC 6749: The authorization server issues the registered client a client identifier -- a unique string representing the registration ...
0
votes
0answers
22 views

oauth2 + angular - Most elegant way to pass the JWT auth token

I have an angular application, which is querying an API as a client (written on Spring Boot 2.2.1 + Spring 5.2.1) that supports 3rd party authentication over OAuth2. The API has altogether 3 different ...
2
votes
2answers
92 views

How to combine session-based authentication and stateless REST API

What is the proper way of combining session-based authentication with stateless, token-based authentication for a REST API? Use case: User logs-in in the standard, traditional, session-based way. ...
1
vote
2answers
56 views

Customized access control using OAuth 2.0

I'm designing a enterprise infrastructure monitoring application which has customized needs of access control, beyond roles and authorities. The architecture include multiple nodes of REST API being ...
-1
votes
1answer
42 views

Oauth in Microservices context

I'm trying to implement an oauth2 server to protect the endpoints developed in php. I have some confusions of how would be the flow to protect my endpoints. I understand that my resource server should ...
2
votes
0answers
25 views

Architecting OAuth2 Flow With an API and Static JS Client

I'm building a very security conscious application. (All applications should be security conscious, but this one may contain a lot of red data). Assuming that I will use a Vue/React JavaScript Single ...
0
votes
1answer
28 views

How to dynamically create and assign user permissions for a group based service

tldr: In building a platform where users can create private groups, and invite other people to those private groups, how is it be to secure those groups? I'm building a platform around private groups ...
1
vote
2answers
378 views

How to keep user logged in when using OpenID Connect & Cookies in dotnet core?

I'm working on an OpenID Connect Hybrid flow, basically the response type in my case is: code id_token Problem: I can't seem to persist the session of the user when logged in using the id_token. I ...
0
votes
0answers
21 views

Put a federation account system or account credential synchronization

We want to put in place a regional saling system for a chain store. A local independant store already have a saling website in place. One of our problem is to identify a user with his already known ...
0
votes
1answer
131 views

What's the point of logging in with oauth2 if it's a paid subscription site?

I understand what oauth2 is and I've programmed it in one of our projects. The point was to pull user's data from an oauth2 provider (facebook, google, etc.) to our application (for example, the user'...
2
votes
3answers
716 views

Is caching Access Tokens on the back end of a Web Application a good idea? (access_token storage best practices)

Let's suppose we have a Web Application that uses an Open Id Connect service provider, the Web Application uses the Authorization Code flow to get access to a different API, and therefore gets an ...
1
vote
1answer
70 views

OAuth2.0 Grant Type for User Logged In With Google

I have a confusion. So, in OAuth2.0 there are 4 types of Grant (Authorization Code, Password, Client Credentials and Implicit). In my use case, I have two login scenario. The first one is using ...
0
votes
1answer
93 views

Creating and Approving OAuth2 clients using Laravel Passport

As I understand with laravel passport, in order for a third party application to consume my api they need to register their application with mine by creating a client. The passport:client artisan ...
1
vote
2answers
23 views

Open ID Connect Session Management Access/Refresh Token vs Session iFrame

We have a web app in which we allow users to log into the app using any Open ID provider(e.g. Okta, Google, Facebook etc.). We want to implement the correct Open ID Connect prescribed methodology/...
2
votes
2answers
244 views

How to generate an access token using OAuth 2.0 for another app that never expires

I'm using OAuth 2.0 with Laravel (Passport) in order to grant access to my frontend app to the API. Access tokens generated this expires after a while. Now, I have a second app that has to consume ...
2
votes
0answers
32 views

OAuth2 - client_credentials

I am in the process of building out a private REST API. This API is intended for machine to machine communication. In short someone else's server will kick off a job via CRON that pulls information ...
0
votes
0answers
39 views

Which OAuth2 Flow?

I'm just getting into OAuth2 and I'm a tad confused (you've probably heard that before)! I am writing a small independent service which will expose a basic REST API enabling client applications to ...
3
votes
2answers
194 views

So I am creating a user registration system with oauth login to four services. How do I handle username selection?

My registration system normally asks for 4 things: The user's full name, their email, their preferred username, and a password. I want to add four oauth2 registration services to make it easier and ...
8
votes
2answers
339 views

Should an SPA use OIDC's Implicit flow or Auth Code flow?

We are developing a new Angular SPA which leverages Keycloak for its SSO abilities using OpenID Connect (OIDC). The app is currently designed to use the Implicit flow to retrieve short-lived access ...
-2
votes
1answer
51 views

Should API also authenticate users from front end app?

I am building an API using Laravel and am looking at using Laravel/Passport for authentication - but I am struggling with a design decision. The API will be consumed by multiple other applications / ...
1
vote
0answers
383 views

How to make rest api end points in swagger UI pre authenticated in Spring BOOT

I have written a spring boot rest API application with OAuth.I have integrated swagger UI for API documentation. I want the API endpoints on swagger UI to be accessible without an access token. Please ...
1
vote
1answer
275 views

User identity and microservices

I have created a User service that controls user login using OAuth2 protocol and stores the user in the local database. So this service is aware of the user session and user identity. Now I have ...
8
votes
1answer
2k views

How to handle per-resource (fine grained) permissions in OAuth?

I'm designing an app architecture using OAuth 2.0. I have a separate Resource Server and Authorization Server. The latter keeps a database of users and the scopes available to them. Now, my question ...
4
votes
3answers
2k views

Token based vs session based authentication in back-end

I'm trying to build an application by creating an RESTful API(Koa.js) to communicate with clients(Web with React and Mobile with Ionic). But I'm facing issues when dealing with authentication. So my ...
1
vote
1answer
940 views

Can I have a client-side-only web application keep OAuth tokens?

I'm only a student, so forgive me if my understanding is poor or my ideas poorly expressed. I want to create a purely client-side browser application that works with the user's Dropbox account. They ...
0
votes
1answer
55 views

Oauth2.0 implementation to be done client side or server side

My application consist of a web client (implemented in angular or reach) and rest web service, both hosted on different servers. For implementing the OAuth2.0 login for Google, Facebook etc., should i ...
0
votes
1answer
57 views

OAuth used for registration

When I read and watch videos on Oath it talks more about being able to access data from other applications. However, a common usage of what I think is OAuth is simply identifying a user without ...
1
vote
1answer
427 views

Windows Service with authentication, some UI required

I have to build a Windows Service which requires OAuth2 authentication. The service is intended (like all services should be) to run unattended (no user need to be logged in in Windows). The problem ...
0
votes
1answer
1k views

How Immadiately Blacklist and Block Access of Access Token using JWT?

I have read OAuth2 and its statelessness using JWT as token. Token expires based on expired time, then how do I control token like blacklist and block its access immediately without being stateful? ...
1
vote
0answers
636 views

What is the “recommended” way of using Asp.Net core, Angular, and OpenID-Connect

I mainly just want a lead in a direction with this. I'm not asking about specific frameworks to use, even if I mention them, just how it's supposed to work. I am trying to get an understand of how ...
1
vote
2answers
503 views

Does it make sense to create a whole new API interface to just handle the web secret key?

In OAuth2.0 we have to send client id and secret along side the user credential to obtain an access token from an authorization server. We have a ReactJS web application that needs to send its request ...
4
votes
1answer
695 views

Multiple OAuth2 access_tokens on the same page

We have been tasked with implementing a dashboard containing multiple widgets. The dashboard itself and all widgets need to access various secured APIs. Our authorisation protocol is OpenID. ...
2
votes
1answer
531 views

Best strategy for OAuth2.0 across browsers and across tabs within the same browser?

I have developed a login system using OAuth2.0 that is currently working within one tab in one browser. Without diving into the code, the system works by having the user enter their credentials to ...
-1
votes
1answer
169 views

How to manage user information with an external user database?

I'm developing an app suite that uses an OpenID Connect provider. But I guess my question works in all situations where there is a separate user info provider. I persist which users create a given ...
1
vote
2answers
1k views

How are resource owner credentials stored in OAuth2

I have been researching oauth2 as of recent and trying to draft an implementation plan. However I seem to be missing something, or something hasn't quite clicked yet. I plan on creating an api and ...
0
votes
1answer
228 views

Remote authorization on each REST resource request

We have a microservices architecture. One of the components is an Authentication & Authorization Service, which implements OAuth2 standard using encrypted JWTs. On each authentication of a user to ...
0
votes
1answer
405 views

Which OpenID flow should I choose?

I have simple REST API, based on Asp.Net Core technology. Now, I want to add OpenID for this API. API would be used from mobile applications, single page applications and possibly other API services ...
1
vote
1answer
506 views

How often should I be checking access tokens if I am using OAuth only for signing in to my app?

Disclaimer: I am asking this question with regard to a school project. The purpose of the project is hands-on learning and simulation of a real-world software development project. I am fully aware ...
2
votes
2answers
1k views

Circular dependency in microservices architecture for Authentication

We are planning on using OAuth2 / OpenID-connect for Authentication & Authorization and I'm looking at what services would be required. So far I've identified that I need at a minimum: An OpenID-...
0
votes
2answers
577 views

Micro services REST with Javascript user authentication/authorization

I am fairly new to the microservice architecture. I am trying to build a web application in this kind of way. After some research online about microservices and having experience with Spring and ...
1
vote
0answers
608 views

Web API authentication Architecture 4 layers

Note: I am no architect nor security expert, I will try my best to explain. Currently I have been tasked to set up a new Web API2 asp.net, c#. The layer is as follows... Client >> New(public) Web ...
3
votes
2answers
986 views

REST API Oauth 2 - Which grant type to use?

I have an application which basically inserts some rows from the current front end web application. All the calls before the service layer checks/validates if the user is allowed to insert data or ...
1
vote
1answer
7k views

How to integrate Laravel passport, oauth scopes and roles and permissions

I am developing SPA in angular and backend API in laravel 5.3. I have integrated Laravel Passport for oauth. I have to make roles and permissions implementation using views on tables from other ...
2
votes
1answer
4k views

Architecture for OAuth2 - BackendServer - FrontendServer

I'm developing an whole ecosystem with an OAuth2 Provider, a Backend Server and a Frontend Server. OAuth2 Provider: provide only the authentication/authorization for the user, and a few other general ...
9
votes
1answer
1k views

What does Identity Server offer that ASP.NET Core Identity does not

I'm trying to get my head around the big picture when producing a new website using ASP.NET Core. I want users to my website to be able to register and log in with social media such as Facebook and ...
10
votes
1answer
1k views

How to migrate existing legacy webapp to use OAuth2

I currently have a 15 year old legacy monolithic webapp with close to 1 million users, using a home-grown authorization & authentication system: JAAS, user names & pwds store in a DB with ...
1
vote
0answers
40 views

Should requests using OAuth2 rely solely on the bearer token?

I'm using OAuth2 to secure an API. This API will be used solely by a known website and some Cordova apps. The website will send always send a corresponding referer header. The Cordova app will always ...
0
votes
1answer
765 views

How to create a single login service to use it in multiple sites ? (similar to Google, Microsoft Account)

I want to implement login system where same user account can be used to login in different web applications. How can I achieve this ? I want to make a similar architecture to Google and Microsoft ...
5
votes
5answers
376 views

Should I treat a worker as another 'user' in my system?

Basically I am designing a web-enabled application that should have an API in the middle. I found this question on Stack Overflow, which unfortunately has no answers. Let's say there is a system, ...