I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below.
- User sends LDAP username and password (with password grand type) to the server.
- Server validates the password communicating with the LDAP server If valid, server returns an access token and a refresh token.
User keeps accessing APIs with access token until expired. When expired, the refresh token can be used to get a new access token and a new refresh token. The user can keep accessing the APIs forever updating the tokens.
Another requirement is making tokens invalid when user password is changed or when the user is disabled in the LDAP server. Is there anyway to do this?
So far I tried following approach:
Store the LDAP password hash in the server when initially user sends them. When refreshing the token, fetch password hash of the user from the LDAP server and compare them to the one saved in the server. But it looks like it's not always possible to fetch the hash. It depends on the LDAP configuration,directory and Permissions