Questions tagged [oidc]
The oidc tag has no usage guidance.
13
questions
0
votes
0
answers
11
views
Using `react-oidc-context` and storing the `access_token` and `refresh_token` together
I am looking for a "best practises" approach for creating SPAs protected using OIDC + PKCE.
Most of our applications are hosted on two independent web servers with a load balancer routing ...
- 1
0
votes
0
answers
18
views
What risks are there in using an OAuth2 access_token from an IdP that I do not control to secure an API that I do control?
Imagine I host some API. Its exact function is irrelevant to the question, but it needs to have some sort of authorization put in front of it. I want to call Google's APIs, so users can interact with ...
- 194
0
votes
0
answers
30
views
OpenId Connect and proper usage of nonce
I understand that a nonce is used to prevent replay attacks. I have been going through documentations, specs, posts and blog posts and I am a little confused.
Consider the following attack scenario.
...
- 43
0
votes
0
answers
94
views
What are the risks of using wildcard in context path of OIDC/OAuth redirect_uri?
I'm using Keycloak for my authentication needs. It allows me to use * as wildcard when whitelisting redirect_uris for OIDC clients. What are the risks of using * in context path of redirect_uri? For ...
-1
votes
1
answer
24
views
Definition of Authorization according to OAuth2
I am trying to understand OAuth2 and OIDC. The OIDC glossary is a good starting point, and while it defines "Authentication", but does not actually define "Authorization". I ...
- 99
0
votes
1
answer
32
views
Downside of resource owner password flow for native mobile apps?
I have seen some similar questions a few years old and I am not sure if there are any new changing views on this.
I see that this flow is not recommended for mobile native apps. What are the practical ...
- 101
0
votes
1
answer
95
views
3rd party mobile app access our service via our APIs
We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service.
We have a customer(a company), ...
- 51
0
votes
0
answers
43
views
OpenId Connect: Is there a way to listen for user events from the IDP
I have an application connecting to any IDP using the OIDC Protocol. This application stores part of the user identity in it's database. The problem I have is when the user gets disabled on the IDP ...
- 101
0
votes
0
answers
55
views
What's the purpose of signing OIDC ID Tokens if they shouldn't be used as bearer tokens
It seems like signing ID Tokens invites misuse.
As I understand it, OIDC ID tokens should not be used as bearer tokens for authorizing API access. Instead, we should use access tokens.
However, the ID ...
- 133
0
votes
0
answers
176
views
OpenId with Biometrics - should I write a custom login + OIDC
We are trying to arrive at a solution for an enterprise app
Different Users have different Authentication Methods
User Type 1 - Password + Captcha
User type 2 - Biometric [Not device-based] + ...
1
vote
1
answer
71
views
What is the purpose of the ID Token if I can get the user info from the userinfo endpoint?
I am trying to understand OIDC and i dont see the purpose of the ID token if with just the access token, i can make a request to the userinfo endpoint and get the user info. What then is the purpose ...
0
votes
1
answer
62
views
OpenId connect: Grant all available scopes in ClientCredentials flow
I have a microservice system with an OpenId connect Identity Provider, implemented with IdentityServer4.
I have one special (very generic) service which needs to be able to communicate with all other ...
0
votes
0
answers
59
views
Working Code for Grant Negotiation and Authorization Protocol (gnap) for evaluation? Performance vs OAuth/OIDC
Understand that Grant Negotiation and Authorization Protocol (gnap) is still in draft status at the IETF.
I am looking to evaluate GNAP and be the first to put in production. Are there any working ...
