I am currently trying to implement my own Authorization Server following the OAuth2 protocol PKCE flow, coupled with my own Identity Provider. The idea is to be able to reuse the same identity provider across multiple SPA. To get a clearer picture I decided to draw a UML sequence diagram. This diagram details the different steps involved in the authorization process but also the authentication.
OAuth2-PKCE-Flow - UML Sequence diagram
Behind the scene my idea was also to implement my own Identity Provider (IdP) to authenticate users. I still want to share some information about Authentication and session management server side. I am using a JWT Token based authentication system, meaning stateless. However, I want to be able to strongly log out users. To do that I am gonna use a refresh token that my Authorization Server will store in a Redis "session store" DB. The latter is then stateful. Regarding the Authentication itself, it's held by the IdP which will verify users credentials. The IdP hosts a login form (simply an HTML page that will be rendered). It's worth saying that, unlike the login form, the consent form is hosted by the Authorization server since the concept of "consent" is only related to authorization.
Here I come with my questions :
What do you think about the flow shown in the diagram? I would definitely appreciate any feedback
I've tried to understand the concepts of Identity Provider and Authorization Server and how they interact with each other. I am not exactly sure who is supposed to generate the tokens (access and refresh). I would say it's the job of the Identity Provider since token is about authentication? If so, it would mean that the part of my diagram targeting the request/creation of the token is incorrect : Authorization Server would have to request the token from the Identity Provider, whereas now it's the Authorization Server itself which generates the token.
I inspected some web application (google, github, stackoverflow) to see how they deal with their own authentication system. Let's use the example of Stackoverflow. When I choose to log in using my stackoverflow account I expect the application to communicate with the Identity Provider which will provide the login form. The login form that is used is the one from the web-application itself, which means no redirection - we stay put, which makes sense yes. Let's go further, imagine I want to use Stackoverflow as "social login" for my application. The Identity Server I would reach behind the Authorization Server to authenticate should be the same as the one reached earlier when authenticating from Stackoverflow. I am wondering what concretely an Identity Provider is. Can it be that the client application itself plays as Identity Provider (since it hosts the login form)? Or is it just an API that provides endpoints for authenticating and generating tokens?
Even though I think I've got it what the concept of OAuth2 is, as you can see the concept of Identity Provider coupled with the Authorization Server is a little confusing to me.
Btw, I didn't mention that I am implementing all of that in Go.
Thanks for your help!