I'm trying to use OAuth2 for authentication/authorization, but after much reading around, I am confused... I'm trying to understand how OAuth and OpenIDConnect relate to each other, and how exactly I can use them for authorizaton.
From what I understood so far:
- OpenID Connect is best for authentication, OAuth is best for authorization
- OAuth2 authorization is done through scopes
A scope is the permission given BY the user TO a client, validated at the resource server
an OpenID Connect id_token is meant mostly for the client application, to provide user info, and NOT as a way for the resource server to validate the user
Here is my use case:
- I need provide SSO to a set of completely stateless webservices made by us
- OAuth is restricted to resource_owner grant
- The identity server is provided on our side, and connected to an LDAP server
- Only trusted apps can be registered as service providers
And what I'm trying to do, which boggles me:
- Only authorized users can access a given webservice API
So, I need some way to check the permission given BY an external entity TO an user, at the resource server. Which, I believe rules out the use of OAuth for authorization?
I'm not sure how to accomplish this with OAuth/OpenID connect, or even IF it fits my use case.
- Can role-based access be made to work with OAuth2 scopes at all?
- Would it be ok to pass the id_token to the resource server, with a claim containing the user's roles (and discard the access_token altogether)? So the id_token would be used for both authentication & authorization. Given that the id_token is signed and contains hashes, it would be fine, right?
- Should I just authenticate with OpenIDConnect, by checking the presence of the id_token, scrap the access_token altogether, and develop my own role-based authorization system?
Apologies for the wall of text, I'm just not sure if I misunderstanding the scope of OAuth/OpenID Connect here. Am I making the wrong assumptions?