1

I have an (https-only) API that uses OAuth2 for authentication and authorization via access tokens.

Any request to the API needs an access token to the Authorization header. The API validates that this access token is signed by a specific tenant (e.g. google), is targeted to a specific audience, and has some specific scopes.

As a user/service, it would be really helpful if the API would expose, on a public endpoint, such information, so that I know from where I should fetch an access token from (e.g. through PKCE), and which scopes I need to request the token from.

A natural mechanism for this is for the API to have a public endpoint with something like

{
    "provider_uri": "https://accounts.google.com/.well-known/openid-configuration",
    "client_id":"...apps.googleusercontent.com",
    "scope":"openid ..."
}

Is this a valid approach? What other relevant idioms exist to address such problem?

Improve this question

1 Answer 1

Reset to default
1

Yes, it's a valid approach. The metadata is public information.

The implementation depends on the protocol(s) supported by your API. In case of OpenID Connect as the protocol, OpenID Connect Discovery specification talks about the metadata a service can publish to describe various aspects of its implementation. From OIDC Discovery spec:

Once the OpenID Provider has been identified, the configuration information for that OP is retrieved from a well-known location as a JSON document, including its OAuth 2.0 endpoint locations. [...]

The response is a set of Claims about the OpenID Provider's configuration, including all necessary endpoints and public key location information.

Improve this answer
2
  • I believe that this quote refers to an identity provider, e.g. google itself (accounts.google.com/.well-known/openid-configuration). I am asking about what an API can publicly provide for a client to know where to authenticate against.
    – Jorge Leitao
    May 28, 2020 at 18:32
  • 1
    The entity that owns the endpoint would be providing metadata about the endpoint. If you build the service and expose the API via an endpoint, you are the owning entity.
    – identigral
    May 28, 2020 at 19:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .