1

after some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd party API access token?).

Let's say I have my resource server (my-api.com), my identity provider and authorization server (my-idp.com) and have an client app (native or browser) (com.my-app).

The standard use-case is implemented with the authorization grant flow.

I now have a new use-case, where I need to request data from a 3rd party resource server (other-api.com). The 3rd party has an identity provider as well and offers OAuth 2.0 authorization and OpenID authentication flows. Resource owners of the 3rd party need to give their consent to my application so I can request their data and further use it in my application.

My questions are the following:

Is the on-behalf-flow what I need? It seems to be for two APIs which I control, not for 3rd party APIs.

How do I handle the 3rd party access, refresh and id token to make requests on-behalf of the resource owner?

  1. I could store the 3rd party tokens in my-api.com and append it to every request I do to request data for my user?
  2. I could store the 3rd party tokens in my-idp.com next to my user information?
  3. I could send the 3rd party tokens to com.my-app which would result in two tokens for each party. This seems to be awkward.

I would go for option 2 and would extend the functionality of my-idp.com. Is this a valid approach? My API my-api.com would then fetch the 3rd party tokens before it does requests on-behalf of my user.

Thanks.

Improve this question

2 Answers 2

Reset to default
0
+100

It's actually depends on what you need such token for.

  • If you are going to use token internally-only, it's number 1.

  • If you're going to provide the user way to do some third party activities from your client app (allow user to share content of the app via Facebook post) -- then it's number 3.

  • And if you need both -- it's number 2, with caching on 1 and 3.

Improve this answer
2
  • Thanks! Is there any RFC or similar?
    – johannespartin
    Commented Mar 18, 2020 at 15:14
  • No, as far as i know. Most of these comes from experience through trial and error :)
    – Dmitry Arkhipenko
    Commented Mar 19, 2020 at 19:05
0

You're going to need to go through the authorization grant flow again with the 3rd party resource and identity provider in the same way you did with your initial resource and idp.

Improve this answer
2
  • Thanks for your answer. But where do I store the 3rd party token?
    – johannespartin
    Commented Mar 16, 2020 at 15:08
  • Usually it's session storage
    – akdombrowski
    Commented Apr 15, 2020 at 14:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .