i want know if permissible pass user's oauth 2.0 access token between applications , use method of logging them in.
i have iphone application uses password grant authenticate user, , uses access token future requests. iphone application able open our website in tab, , want user logged in our website when tab opens.
under oauth 2.0 spec, permissible pass token web request , have the web server authenticate , log user in request?
for example, browser might open following location (but use header, instead of query string):
https://example.com/account?access_token=foo_bar
alternatively, dedicated endpoint oauth authentication , redirect used.
so in effect, question in 2 parts; can oauth 2.0 token shared between application contexts , can token used authenticate user in context?
in oauth 2.0 spec (rfc 6749), there couple of areas may relevant. client
can receive access_token
accepted multiple resource_servers
if client
comprised of multiple components
different security contexts, should register each 1 , use different token:
single token across multiple resource servers
a single authorization server may issue access tokens accepted multiple resource servers.
single client multiple components
a client may implemented distributed set of components, each different client type , security context (e.g., distributed client both confidential server-based component , public browser-based component). if authorization server not provide support such clients or not provide guidance regard registration, client should register each component separate client.
Comments
Post a Comment