I want to accomplish the following:

  1. Having a web application or mobile app authenticating users using openid connect.
  2. Having a REST Api authenticated using openid connect using the same user as for point 1.
  3. The user should not have to consent since the API is trusted (but not for SPA's)

For point 1 we have a working proof-of-concept. But for point 2 I am not sure what is the best way (also security-wise) to accomplish that.

Option 1:

  • Use the same username and password as for the web application. This means that the username and password need to be cached somehow before accessing the API client side. Aside of the caching this has been proved to work using OAUTH2 only.

This was being accomplished by using:

curl -H "Authorization: Basic <my token>" --data-binary "realm=<mysecretrelam>&grant_type=password&username=<username>&password=<password>&scope=<my scopes>" <my secret openidconnect>/oauth2/access_token
  • Use the authorization token returned from the OIDC authentication for the website. I did not manage to make this work, which endpoint should be used on the OIDC authentication service to (sort of) SSO the user on the webapi?
  • Something else...
  • I'm confused by you saying "same username and password as for the web app". Are you using OIDC for authentication, or passwords for authentication? Or both, somehow? Anyhow, the usual solution is to either use the OAuth/OIDC token to authorize/authenticate to your REST API (placing session management largely in the hands of the OIDC authentication server), or use the OIDC token to create a local session for the identified user, and use that session token (whatever type of token you want) to authorize access to the REST API.
    – CBHacking
    Aug 19 at 7:00
  • You are using OIDC so what is the purpose of username and password?
    – defalt
    Aug 19 at 8:23
  • We use OpenID/OAuth2 with username and password to log on the web application. (grant_type=password), I have added it to the question Aug 19 at 8:51
  • This is called OIDC ROPC which is discouraged. You are not supposed to know the username and password of the user. Use authorization code flow for web app. For browserless client, you can issue access tokens on request of the user by refreshing the access token in cookies. Then use token introspection to verify the access token sent by REST API clients.
    – defalt
    Aug 19 at 14:46
  • @defalt, so otions one is of the table in that case. I read the authorization code should be used in that case. Aug 22 at 5:28


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy