I have a REST API that is used by 2 separate application and is authenticating them by M2M OAuth2 Client Credential Flow.

enter image description here

One of the two application is an automation service without user context. The second one is a REST API where users authenticate with OAuth2 Implicit Flow.

Now I need to include the user context in my common REST API too, since some information should only be shared to certain users.

What is a secure strategy to implement that scenario with OAuth2? I thought I could just include the user (or a fixed string in case of the automation service) into the Access Token of the Client Credential Flow but that doesn't seem possible.

  • Are there only API-2-API requests? Are you using only OAuth2 for authorization or also OpenIDConnect to authentication? I need this info to better understand the question. Apr 2 '20 at 10:51

If you are able to authenticate the end-users as well as the client server, it's better to use the Authorization Code flow.

Alternatively, check the user context during the API call instead of in the authentication step.

  • the end-users I'm only able to authenticate in the case of the first, application REST API. The automation server is not running in the context of an end-user
    – user66875
    Mar 9 '20 at 11:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.