Questions tagged [oidc]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
11 views

Using `react-oidc-context` and storing the `access_token` and `refresh_token` together

I am looking for a "best practises" approach for creating SPAs protected using OIDC + PKCE. Most of our applications are hosted on two independent web servers with a load balancer routing ...
user avatar
0 votes
0 answers
18 views

What risks are there in using an OAuth2 access_token from an IdP that I do not control to secure an API that I do control?

Imagine I host some API. Its exact function is irrelevant to the question, but it needs to have some sort of authorization put in front of it. I want to call Google's APIs, so users can interact with ...
user avatar
0 votes
0 answers
30 views

OpenId Connect and proper usage of nonce

I understand that a nonce is used to prevent replay attacks. I have been going through documentations, specs, posts and blog posts and I am a little confused. Consider the following attack scenario. ...
user avatar
  • 43
0 votes
0 answers
94 views

What are the risks of using wildcard in context path of OIDC/OAuth redirect_uri?

I'm using Keycloak for my authentication needs. It allows me to use * as wildcard when whitelisting redirect_uris for OIDC clients. What are the risks of using * in context path of redirect_uri? For ...
user avatar
-1 votes
1 answer
24 views

Definition of Authorization according to OAuth2

I am trying to understand OAuth2 and OIDC. The OIDC glossary is a good starting point, and while it defines "Authentication", but does not actually define "Authorization". I ...
user avatar
0 votes
1 answer
32 views

Downside of resource owner password flow for native mobile apps?

I have seen some similar questions a few years old and I am not sure if there are any new changing views on this. I see that this flow is not recommended for mobile native apps. What are the practical ...
user avatar
  • 101
0 votes
1 answer
95 views

3rd party mobile app access our service via our APIs

We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service. We have a customer(a company), ...
user avatar
0 votes
0 answers
43 views

OpenId Connect: Is there a way to listen for user events from the IDP

I have an application connecting to any IDP using the OIDC Protocol. This application stores part of the user identity in it's database. The problem I have is when the user gets disabled on the IDP ...
user avatar
0 votes
0 answers
55 views

What's the purpose of signing OIDC ID Tokens if they shouldn't be used as bearer tokens

It seems like signing ID Tokens invites misuse. As I understand it, OIDC ID tokens should not be used as bearer tokens for authorizing API access. Instead, we should use access tokens. However, the ID ...
user avatar
0 votes
0 answers
176 views

OpenId with Biometrics - should I write a custom login + OIDC

We are trying to arrive at a solution for an enterprise app Different Users have different Authentication Methods User Type 1 - Password + Captcha User type 2 - Biometric [Not device-based] + ...
user avatar
1 vote
1 answer
71 views

What is the purpose of the ID Token if I can get the user info from the userinfo endpoint?

I am trying to understand OIDC and i dont see the purpose of the ID token if with just the access token, i can make a request to the userinfo endpoint and get the user info. What then is the purpose ...
user avatar
0 votes
1 answer
62 views

OpenId connect: Grant all available scopes in ClientCredentials flow

I have a microservice system with an OpenId connect Identity Provider, implemented with IdentityServer4. I have one special (very generic) service which needs to be able to communicate with all other ...
user avatar
0 votes
0 answers
59 views

Working Code for Grant Negotiation and Authorization Protocol (gnap) for evaluation? Performance vs OAuth/OIDC

Understand that Grant Negotiation and Authorization Protocol (gnap) is still in draft status at the IETF. I am looking to evaluate GNAP and be the first to put in production. Are there any working ...
user avatar