Authenticating on the client with OpenID Connect using Authorization Code flow?

Question

Our company has a series of software suites that we are tying into a single OpenID Connect Resource Server. All but one of our applications can use Authorization Code flow as normal, redirecting Resource Owners to the Resource Server's authentication page to check credentials before being sent back to the Client.

However, we do have an e-commerce application in which we would like to allow the user to log in from the Client site itself. For example, if a user has not logged in and is in the checkout process, we don't want the user to have to interrupt the flow in order for the Resource Owner to log in.

We own both the Resource Server and the Client, so I know that we can use Resource Owner Password flow in order to accommodate this scenario. My question, however, is if we can somehow use Authorization Code flow in some way so that the Resource Owner does not have to leave the Client in order to authenticate?

Answer 1

The main idea of the authorization grant flow that the client does not know user credentials at all. So there is no legal way to do it.

But as WA you can try to send authorization request directly to Authorization Server and emulate redirect behind the scene (with assumption that you owns both client and server and takes the responsibility for breaking the spec ).