All Questions
Tagged with oauth2 authorization
16 questions
3
votes
1
answer
68
views
Next Auth Flow For Use with Ruby on Rails API
I plan to have a frontend web app written with Next.js using the AuthJS library to provide user authentication using Oauth. This frontend application depends on a backend API. I want to make sure my ...
- 139
1
vote
0
answers
161
views
OpenID Connect and User Management Best Practices
Currently my company has 2 applications that use Identity Server for SSO. Not every client we have uses both applications but some do. The part I'm uneasy about is that both apps have a user ...
- 146
0
votes
1
answer
431
views
How to secure messaging-based communication with microservices
I'm comfortable with a lot of OpenID Connect and OAuth2 concepts in the context of HTTP-based communication between microservices. I'm currently leveraging Azure AD.
In the HTTP-based scenario I would ...
- 3
2
votes
1
answer
783
views
Delegating authorization across multiple API's
I'm building a multi-tenant system that consists of one (SPA) client, calling multiple API's, all under my control.
User authentication is done with OpenID Connect, I'm sending an ID and access token ...
- 129
3
votes
3
answers
366
views
Auth in microservices applications with service mesh
Premise:
- Two services A and B
- Resource X has owner U, and is managed by service B
Now, I need to handle these auth scenarios:
1- End-user needs to directly use service B's API to access X
2- ...
- 139
2
votes
0
answers
34
views
OAuth2 - client_credentials
I am in the process of building out a private REST API. This API is intended for machine to machine communication. In short someone else's server will kick off a job via CRON that pulls information ...
- 121
0
votes
1
answer
257
views
Remote authorization on each REST resource request
We have a microservices architecture. One of the components is an Authentication & Authorization Service, which implements OAuth2 standard using encrypted JWTs. On each authentication of a user to ...
- 111
0
votes
1
answer
430
views
Which OpenID flow should I choose?
I have simple REST API, based on Asp.Net Core technology.
Now, I want to add OpenID for this API.
API would be used from mobile applications, single page applications and possibly other API services ...
- 341
0
votes
2
answers
744
views
Micro services REST with Javascript user authentication/authorization
I am fairly new to the microservice architecture. I am trying to build a web application in this kind of way. After some research online about microservices and having experience with Spring and ...
- 103
3
votes
2
answers
1k
views
REST API Oauth 2 - Which grant type to use?
I have an application which basically inserts some rows from the current front end web application.
All the calls before the service layer checks/validates if the user is allowed to insert data or ...
- 103
1
vote
1
answer
802
views
OAuthv2 access tokens and resource servers
In the OAuthv2 authorization grant, a “client app” authenticates itself against an “auth server”, and receives an “access token” for accessing resources living on a “resource server”.
My concerns:
...
- 4,920
4
votes
1
answer
1k
views
OAuthv2 for distributed applications
Please note: Months ago I asked this question that received a truly amazing answer and introduction to OAuthv2. I’m now knee deep in the implementation of such a system and have similar (but notably ...
- 4,920
10
votes
2
answers
6k
views
Auth options for distributed systems
I am in the process of designing 3 components that will work in symphony with one another:
A RESTful web service which requires BasicAuth over HTTPS on all calls, and which is what actually does all ...
- 4,920
1
vote
1
answer
98
views
OAuth/OAuth2 RFC question
This question is about a line from the OAuth2 rfc - https://www.rfc-editor.org/rfc/rfc6749
In Section 2.3, there is this line
The client MUST NOT use more than one authentication method in each ...
- 441
4
votes
0
answers
836
views
Oauth 2 store access token vs verifying on each call
Let's say my Server is both Authorization Server and Resource server
My Client (for example mobile app) can authenticate in 2 matters:
via Resource Owner Password Credentials Grant
via ...
- 217
8
votes
3
answers
2k
views
OAuth alternative for a 2 party system
I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database.
I do ...
- 183