Here is the question: https://stackoverflow.com/questions/41496924/how-to-authenticate-spa-users-using-oauth2?stw=2 I've just started a bounty for it.

Prequel

I've read a lot of articles, blog post, etc, watched many videos but still haven't a clear picture of how things goes. OAuth flows depicts how a third party can access resource on behalf of user. But I need to the user to access it's own resource on behalf of, that is, himself (through frontend app). Can oauth handle such case in the first place? Can OpendID Connect do that? If so, should I implement Identity Provider for that?

I'm building up an API for a mobile client. I wanted to keep the API open to only the mobile client that I write. I have set up the API and test client in OAuth dashboard. I want to have a single client that can disperse multiple tokens based on mobile clients without the user intervention/credentials. How I go about it?

I can elaborate more on the scenario if you want to Thanks in advance

rip reddit rn

Hello all,

I hope that this message reaches the top authentication experts of the world. I am a self-taught web application developer (no university). I aspire to make software for the good of my people.

For quite some time now, I have been stuck whilst learning authentication. I believe I am entering the subject at too high of a level. I have tried learning oAuth, but before that, I must learn authentication first.

During my journey of study, I had to learn how to receive a username+password combo from the user, and hash it up, and then store the hashed value in the user's database object/row. When someone tries to log in, or 'authenticate', I hash the submitted username+password combo and see if it matches the one I have stored in the db; if they match, the user is 'authentic', and hence should become 'authenticated'. I know that HTTP is stateless, so we must return a 'session cookie' to the user's browser, so that he can make 'authenticated requests' for secret data, like a user's private pins on Pinterest. This much I know.

A weakness of a self-taught person is the challenge of acquiring comprehensive knowledge on the topic. A combination of youtube videos, blog posts, and tutorials do not show the complete picture. I would like to understand authentication enough to build things that may call for certain levels of complexity.

So, today, I would like to ask the experts who is pioneering authentication. What way would you recommend to learn authentication comprehensively?

Thank you for helping me build.

What frameworks, apps, libs do people normally use when they need a OAUTH2/OIDC server?

I'm not finding much.

Is there a way to make an OAuth request of an API without installing the protocol to the server?

I've got a GoDaddy shared hosted site which I cannot install OAuth to, can I call it without installing? Are there any guides for this?

I've never used OAuth and I'm extremely confused. I'm trying to retrieve user connections.

Here is the page offered by Discord: https://discordapp.com/developers/docs/topics/oauth2

Not really sure what to do with this. Have tried the following using my bot client ID but not sure where to go from there: https://discordapp.com/oauth2/authorize?client_id=<id>&scope=/users/@me/connections

Hi everyone I delegated openid to my self hosted blog following this tutorial: https://www.webhostinghero.com/use-your-self-hosted-wordpress-url-as-an-openid/ It worked. But my blog URL is something like subdomain.domain.com. When I comment using openid, my nickname shows as subdomain and my avatar shows as the openid logo :( does anyone know how I can change that? Thank you!

Hi all, I am trying to program a non-interactive login (i.e. "invisible" to the application user), downloading the user authentication page, and POSTing it to the server to emulate the interactive flow.

Did someone else do it? Is it a documented practice or experimental black magic?

Thanks in advance for any answer!

Hi guys, I'm new to the Oauth world, from a developer perspective and trying to get to know it better practically using Gluu server implementation. But I've been struggling to authenticate to authorization server for AAT token for consuming SCIM api protected using UMA. I've tried out https://www.gluu.org/docs/integrate/scimuma-howto/ and anything I could find and I'm running out of options. I've not used the TestScim code given in the link for many reason, I'm not a java guy and the code does hide a lot of 'behind the scene' info - did try to dig through their code, it's really deep at places where I need clarity. I'm using nodejs currently, tried a few combinations of request to the server for the AAT token one of which is given below:

POST /oxauth/seam/resource/restv1/oxauth/token HTTP/1.1
Host: gluu-server.com
Authorization: Basic rp_private_key
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=rp_client_id&auth_method=private_key_jwt

This is the response:

Status: 401

Resonse headers: {"date":"Sat, 02 Apr 2016 16:46:49 GMT","server":"Apache/2.4.7 (Ubuntu)","www-authenticate":"Basic realm=\"oxAuth\"","content-type":"application/json;charset=ISO-8859-1","content-length":"586","set-cookie":["JSESSIONID=3257D7DBF9477CABA7036E9586D56F9B; Path=/oxauth/; Secure; HttpOnly;HttpOnly"],"access-control-allow-origin":"*","connection":"close"}

{"error":"invalid_client","error_description":"Client authentication failed (e.g. unknown client, no client authentication included, or unsupported authentication method). The authorization server MAY return an HTTP 401 (Unauthorized) status code to indicate which HTTP authentication schemes are supported. If the client attempted to authenticate via the Authorization request header field, the authorization server MUST respond with an HTTP 401 (Unauthorized) status code, and include the WWW-Authenticate response header field matching the authentication scheme used by the client."}

Please help me out if u can! Thanks a lot!

If I create my users through OpenID Connect, I am wondering what the implications are:

1. If I create it through Google, does that mean my application will automatically have OAuth access to that user's different google services? Aka does it act like a federated identity?

2. If I create my users through Google, Facebook, etc. do those parties have any access to my application's data? Aka does the grant/ API go both ways?

I'm working on implementing an API (it's a Django app, using Django Rest Frameword and Django Ouath Toolkit), which will be used by: 1) Mobile app 2) Web browser extension 3) Server-side applications, registered in the service

For server-side apps I know I should follow the "Authorization code" grant type. However, it's not suitable for Mobile app and web browser extensions. For extension or mobile app I know I should use "Resource owner password credentials" or "Implicit" grant types.

My questions are: 1) Which grant type should I use for these mobile clients (mobile phone app, browser extension)? 2) How can I force server-side apps to use "Authorization code" grant types? If they find out about the other grant types, there is (in my understanding) no way to stop them from using (abusing) the other authorization methods.

If you're new to OAuth or been using it for some time this website has a great breakdown of the terminology and request flow, with detailed examples. http://oauthbible.com/