We're trying to allow a trusted 3rd party web application to automatically authenticate users in our own application. We thought about using oauth2 for that matter.
In our scenario we would provide an oauth2 server and the initial handshake would look something like this (which imho is the regular oauth2 3-legged mechanism). Let's say acme
is the name of our service.
- 3rd party app has a
connect to acme
button - User clicks on that button and is redirected to the acme service
- User logs in via form based login on the acme site
- The Acme service presents the user with the
3rd party wants to access your account
dialog - User clicks
accept
- Acme service generates an oauth2 token and redirects back to 3rd party
- 3rd party stores the generated token for future interactions with the acme service
Now if the session on the acme website is expired, the 3rd party app could automatically re-authenticate the user in the acme web application by sending an ajax request to an authentication endpoint on the acme server.
It will send the previously stored token in via https as a http header to the acme endpoint, where the oauth2 server will validate the token and authenticate the associated user in the web application.
We're wondering if this implies any security issues or if this is a safe oauth2 pattern for automatically re-authenticating existing oauth2 tokens with a oauth2 providers website.
acme
(the service provider)