I'm trying to implement the OAuth2 resource owner flow. My authorization server successfully generates JSON web tokens, so my next step is to implement refresh tokens for my web application.
Everything that I have read explains that when requesting an access token from your authorization server you include the resource server URL as the client_id
. This is then put in an aud claim within your JWT. Is this correct?
If so, my issue arises when I try to implement refresh tokens. Refresh tokens are issued on a per client basis, so that client_id
field now needs to identify the client, and not the resource server URL. With this being the case, my authorization server now doesn't know who to issue the token for, so it doesn't know what to add in the aud
claim within the JWT.
I'm looking for some advice on the best approach to solve this issue in relation to the OAuth2 spec, there doesn't seem to be a concrete answer out there for this problem when mixing OAuth2 and JWT.
Does anyone have any ideas?
My current flow looks like this:
Client sends request to authorization server with username in the
username
field, password in thepassword
field and the resource server it wants access to in theclient_id
field.Authorization server validates the username and password, and checks if it can generate a JWT for the requested resource server.
It returns a token if both of those checks pass, the token contains an
aud
claim which matches theclient_id
that came in the request.