I'm trying to implement the OAuth2 resource owner flow. My authorization server successfully generates JSON web tokens, so my next step is to implement refresh tokens for my web application.
Everything that I have read explains that when requesting an access token from your authorization server you include the resource server URL as the
client_id. This is then put in an aud claim within your JWT. Is this correct?
If so, my issue arises when I try to implement refresh tokens. Refresh tokens are issued on a per client basis, so that
client_id field now needs to identify the client, and not the resource server URL. With this being the case, my authorization server now doesn't know who to issue the token for, so it doesn't know what to add in the
aud claim within the JWT.
I'm looking for some advice on the best approach to solve this issue in relation to the OAuth2 spec, there doesn't seem to be a concrete answer out there for this problem when mixing OAuth2 and JWT.
Does anyone have any ideas?
My current flow looks like this:
Client sends request to authorization server with username in the
usernamefield, password in the
passwordfield and the resource server it wants access to in the
Authorization server validates the username and password, and checks if it can generate a JWT for the requested resource server.
It returns a token if both of those checks pass, the token contains an
audclaim which matches the
client_idthat came in the request.