Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [oauth2]

The tag has no usage guidance.

0
votes
0answers
33 views

What's the recommended way to deal with different authorization roles per microservice in an OAuth2 + JWT token scenario? Stateless vs stateful

Let's suppose an organization with a bunch of frontend applications (angular/react...). Each of them has an associated backend for frontend (BFF) microservice that provides a REST API: Front 1 ------...
1
vote
0answers
33 views

So I am creating a user registration system with oauth login to four services. How do I handle username selection?

My registration system normally asks for 4 things: The user's full name, their email, their preferred username, and a password. I want to add four oauth2 registration services to make it easier and ...
0
votes
0answers
17 views

Is it good idea to build multitenant saas using Webpi2 OData V3, SPA?

I wanna clarify these two questions 1. is it best combination of tools WebApi 2 OData V3 for presentation layer and SPA for front-end (Angular js, Service Worker, MVC) and horizontal scaling of ...
0
votes
0answers
28 views

When is an API Manager/Gateway product necessary? Would you use it for Backend For Frontend services?

I have been using different API Management solutions for quite some time now, as some clients encouraged or forced its use to manage APIs and microservices. However I feel in many cases there could ...
4
votes
0answers
119 views

Should an SPA use OIDC's Implicit flow or Auth Code flow?

We are developing a new Angular SPA which leverages Keycloak for its SSO abilities using OpenID Connect (OIDC). The app is currently designed to use the Implicit flow to retrieve short-lived access ...
-2
votes
1answer
42 views

Should API also authenticate users from front end app?

I am building an API using Laravel and am looking at using Laravel/Passport for authentication - but I am struggling with a design decision. The API will be consumed by multiple other applications / ...
0
votes
0answers
49 views

How to authenticate users across different web-services?

We are building a corporate service website, where users need to log in to access content. The authentication part of that website is fairly stable and part of our code-base. As long as the user is on ...
1
vote
0answers
229 views

How to make rest api end points in swagger UI pre authenticated in Spring BOOT

I have written a spring boot rest API application with OAuth.I have integrated swagger UI for API documentation. I want the API endpoints on swagger UI to be accessible without an access token. Please ...
1
vote
1answer
70 views

User identity and microservices

I have created a User service that controls user login using OAuth2 protocol and stores the user in the local database. So this service is aware of the user session and user identity. Now I have ...
2
votes
1answer
259 views

How to handle per-resource (fine grained) permissions in OAuth?

I'm designing an app architecture using OAuth 2.0. I have a separate Resource Server and Authorization Server. The latter keeps a database of users and the scopes available to them. Now, my question ...
0
votes
0answers
24 views

How can I support application rules inside OpenID (and AD B2C)?

Ciao, I'm working on a multi-tenancy web api project. I would integrate OpenID Connect protocol for authentication and authorization (with Azure AD B2C). I known that that with OAuth 2.0 let ...
2
votes
2answers
489 views

Token based vs session based authentication in back-end

I'm trying to build an application by creating an RESTful API(Koa.js) to communicate with clients(Web with React and Mobile with Ionic). But I'm facing issues when dealing with authentication. So my ...
0
votes
0answers
39 views

OAuth2 authorization and storing users to custom storage

My question is relating to securing API with Google OAuth2 authorization and multiple clients. But I also want to store users to my own storage so I can have additional info about them. So when the ...
1
vote
1answer
139 views

Can I have a client-side-only web application keep OAuth tokens?

I'm only a student, so forgive me if my understanding is poor or my ideas poorly expressed. I want to create a purely client-side browser application that works with the user's Dropbox account. They ...
0
votes
1answer
48 views

Oauth2.0 implementation to be done client side or server side

My application consist of a web client (implemented in angular or reach) and rest web service, both hosted on different servers. For implementing the OAuth2.0 login for Google, Facebook etc., should i ...
0
votes
0answers
30 views

Building multiple unrelated services website but one central user system so I don't have to recreate an authentication system

I have ideas for multiple applications that I would like to create over the next couple years. I do not want to have to make a new authentication system for each website/application. I do not want ...
0
votes
0answers
371 views

Scalable architecture for multi-tenant auth solution

We're evaluating two different architectures for setting up KeyCloak to allow users to grant access to other users and third parties to tenants within our system. I'm looking for experienced feedback ...
0
votes
0answers
31 views

OAuth used for registration

When I read and watch videos on Oath it talks more about being able to access data from other applications. However, a common usage of what I think is OAuth is simply identifying a user without ...
1
vote
1answer
171 views

Windows Service with authentication, some UI required

I have to build a Windows Service which requires OAuth2 authentication. The service is intended (like all services should be) to run unattended (no user need to be logged in in Windows). The problem ...
0
votes
1answer
725 views

How Immadiately Blacklist and Block Access of Access Token using JWT?

I have read OAuth2 and its statelessness using JWT as token. Token expires based on expired time, then how do I control token like blacklist and block its access immediately without being stateful? ...
1
vote
0answers
502 views

What is the “recommended” way of using Asp.Net core, Angular, and OpenID-Connect

I mainly just want a lead in a direction with this. I'm not asking about specific frameworks to use, even if I mention them, just how it's supposed to work. I am trying to get an understand of how ...
1
vote
2answers
329 views

Does it make sense to create a whole new API interface to just handle the web secret key?

In OAuth2.0 we have to send client id and secret along side the user credential to obtain an access token from an authorization server. We have a ReactJS web application that needs to send its request ...
4
votes
1answer
206 views

Multiple OAuth2 access_tokens on the same page

We have been tasked with implementing a dashboard containing multiple widgets. The dashboard itself and all widgets need to access various secured APIs. Our authorisation protocol is OpenID. ...
2
votes
1answer
266 views

Best strategy for OAuth2.0 across browsers and across tabs within the same browser?

I have developed a login system using OAuth2.0 that is currently working within one tab in one browser. Without diving into the code, the system works by having the user enter their credentials to ...
-1
votes
1answer
95 views

How to manage user information with an external user database?

I'm developing an app suite that uses an OpenID Connect provider. But I guess my question works in all situations where there is a separate user info provider. I persist which users create a given ...
1
vote
2answers
800 views

How are resource owner credentials stored in OAuth2

I have been researching oauth2 as of recent and trying to draft an implementation plan. However I seem to be missing something, or something hasn't quite clicked yet. I plan on creating an api and ...
0
votes
1answer
219 views

Remote authorization on each REST resource request

We have a microservices architecture. One of the components is an Authentication & Authorization Service, which implements OAuth2 standard using encrypted JWTs. On each authentication of a user to ...
1
vote
0answers
265 views

Suggestions on building an authentication system with Django Rest Framework, Mongo and auth0

I am trying to get some suggestions on how I should architect the authentication system for a Django rest framework API. The stack looks like this: Django REST framework Django REST framework ...
0
votes
1answer
363 views

Which OpenID flow should I choose?

I have simple REST API, based on Asp.Net Core technology. Now, I want to add OpenID for this API. API would be used from mobile applications, single page applications and possibly other API services ...
1
vote
1answer
236 views

How often should I be checking access tokens if I am using OAuth only for signing in to my app?

Disclaimer: I am asking this question with regard to a school project. The purpose of the project is hands-on learning and simulation of a real-world software development project. I am fully aware ...
2
votes
2answers
778 views

Circular dependency in microservices architecture for Authentication

We are planning on using OAuth2 / OpenID-connect for Authentication & Authorization and I'm looking at what services would be required. So far I've identified that I need at a minimum: An OpenID-...
0
votes
2answers
502 views

Micro services REST with Javascript user authentication/authorization

I am fairly new to the microservice architecture. I am trying to build a web application in this kind of way. After some research online about microservices and having experience with Spring and ...
1
vote
0answers
493 views

Web API authentication Architecture 4 layers

Note: I am no architect nor security expert, I will try my best to explain. Currently I have been tasked to set up a new Web API2 asp.net, c#. The layer is as follows... Client >> New(public) Web ...
4
votes
2answers
664 views

REST API Oauth 2 - Which grant type to use?

I have an application which basically inserts some rows from the current front end web application. All the calls before the service layer checks/validates if the user is allowed to insert data or ...
1
vote
1answer
4k views

How to integrate Laravel passport, oauth scopes and roles and permissions

I am developing SPA in angular and backend API in laravel 5.3. I have integrated Laravel Passport for oauth. I have to make roles and permissions implementation using views on tables from other ...
0
votes
0answers
206 views

Oauth2 REST API: for 3rd party and internal

I have Oauth2 REST API. There are 3rd party applications (server (like web app) and client (like mobile app)). We want to add some functionality to this API which could be used only by our official ...
2
votes
1answer
3k views

Architecture for OAuth2 - BackendServer - FrontendServer

I'm developing an whole ecosystem with an OAuth2 Provider, a Backend Server and a Frontend Server. OAuth2 Provider: provide only the authentication/authorization for the user, and a few other general ...
9
votes
1answer
782 views

What does Identity Server offer that ASP.NET Core Identity does not

I'm trying to get my head around the big picture when producing a new website using ASP.NET Core. I want users to my website to be able to register and log in with social media such as Facebook and ...
11
votes
1answer
618 views

How to migrate existing legacy webapp to use OAuth2

I currently have a 15 year old legacy monolithic webapp with close to 1 million users, using a home-grown authorization & authentication system: JAAS, user names & pwds store in a DB with ...
1
vote
0answers
38 views

Should requests using OAuth2 rely solely on the bearer token?

I'm using OAuth2 to secure an API. This API will be used solely by a known website and some Cordova apps. The website will send always send a corresponding referer header. The Cordova app will always ...
0
votes
1answer
601 views

How to create a single login service to use it in multiple sites ? (similar to Google, Microsoft Account)

I want to implement login system where same user account can be used to login in different web applications. How can I achieve this ? I want to make a similar architecture to Google and Microsoft ...
6
votes
5answers
373 views

Should I treat a worker as another 'user' in my system?

Basically I am designing a web-enabled application that should have an API in the middle. I found this question on Stack Overflow, which unfortunately has no answers. Let's say there is a system, ...
5
votes
0answers
483 views

Storing OAuth2 data in Mongo?

Our system has users but we want to perhaps allow some users to be able to use our API service. I'm looking at using OAuth2 for authorization. As it's going to be (trusted) machine-to-machine access I ...
1
vote
0answers
52 views

Using JWT over Oauth2.0

I am creating an API that will communicate with a ReactJS app. I am in two minds whether to go through with the implementation of OAuth2.0. The question is why should I use OAuth2.0 implicit grant ...
8
votes
1answer
693 views

Is this a correct JWT authentication implementation?

I've created a Flask RESTful API which requires an email / password and Facebook login flow. This will probably need to be extended in the future to support more social logins. I've chosen to ...
7
votes
1answer
213 views

Is OAuth 2.0 ok for building a container of applications?

I need to create a container app which contains several apps (imagine something like iCloud): once I've been logged in, I can see all the apps by means of icons, click on them and use them (a new tab/...
2
votes
2answers
95 views

Proper OAuth2 Grant

I'm looking to build a mobile application (iOS / Android) that digests information from a secured API. The API will require OAuth2 authentication to be able to digest any resources. The service I'm ...
3
votes
1answer
595 views

Social auth from mobile app connected to API server

I have a Node.js server using PassportJS that uses social login via Google, Facebook, and Twitter. The Node.js server hosts an API that uses the PassportJS middleware to authenticate routes and ...
3
votes
0answers
84 views

Architecting an account system for oauth that bridges a new and legacy system

So this question is specific to implementing auth in our system but I'm looking for high-level (just the architecture) solution or advice on which direction to head towards. Overview (TL;DR) Our ...
2
votes
1answer
437 views

OAuthv2 access tokens and resource servers

In the OAuthv2 authorization grant, a “client app” authenticates itself against an “auth server”, and receives an “access token” for accessing resources living on a “resource server”. My concerns: ...