Down-party - OAuth 2.0

FoxIDs down-party OAuth 2.0 enable you to connect an APIs as OAuth 2.0 resources. And connect your backend service using Client Credentials Grant.

OAuth 2.0 Resource

An API is configured as a down-party OAuth 2.0 resource with a name and one or more scopes.

A client can subsequently be given access by configuring resource and scopes in the client.

Client Credentials Grant

An application using Client Credentials Grant could be a backend service secured by a client id and secret. PKCE is not validated in Client Credentials Grant.

• Specify client name in down-party name.
• Specify redirect URI.
• Select token as response type.
• Disable PKCE.
• Specify a secret.
• Optionally grant the client access to call the party-api2 resource with the read1 and read2 scopes.

Access tokens can be issued with a list of audiences and thereby be issued to multiple APIs defined in FoxIDs as OAuth 2.0 resources.

Change the claims the down-party pass on with claim transforms.

Resource Owner Password Credentials Grant

Resource Owner Password Credentials Grant is not supported for security reasons because it is insecure and should not be used.

Client secrets

It is important to store client secrets securely, therefor client secrets are hashed with the same hash algorithm as passwords. If the secret is more than 20 character (which it should be) the first 3 characters is saved as information and is shown for each secret in FoxIDs Control.