0

I have a REST API that is used by 2 separate application and is authenticating them by M2M OAuth2 Client Credential Flow.

enter image description here

One of the two application is an automation service without user context. The second one is a REST API where users authenticate with OAuth2 Implicit Flow.

Now I need to include the user context in my common REST API too, since some information should only be shared to certain users.

What is a secure strategy to implement that scenario with OAuth2? I thought I could just include the user (or a fixed string in case of the automation service) into the Access Token of the Client Credential Flow but that doesn't seem possible.

Improve this question
1
  • Are there only API-2-API requests? Are you using only OAuth2 for authorization or also OpenIDConnect to authentication? I need this info to better understand the question.
    – Bartosz Rosa
    Apr 2, 2020 at 10:51

1 Answer 1

Reset to default
0

If you are able to authenticate the end-users as well as the client server, it's better to use the Authorization Code flow.

Alternatively, check the user context during the API call instead of in the authentication step.

Improve this answer
1
  • the end-users I'm only able to authenticate in the case of the first, application REST API. The automation server is not running in the context of an end-user
    – user66875
    Mar 9, 2020 at 11:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .