Down-party - OAuth 2.0
FoxIDs down-party OAuth 2.0 enable you to connect an APIs as OAuth 2.0 resources. And connect your backend service using Client Credentials Grant.
OAuth 2.0 Resource
An API is configured as a down-party OAuth 2.0 resource with a name and one or more scopes.
A client can subsequently be given access by configuring resource and scopes in the client.
Client Credentials Grant
An application using Client Credentials Grant could be a backend service secured by a client id and secret. PKCE is not validated in Client Credentials Grant.
- Specify client name in down-party name.
- Specify redirect URI.
- Select
token
as response type. - Disable PKCE.
- Specify a secret.
- Optionally grant the client access to call the
party-api2
resource with theread1
andread2
scopes.
Access tokens can be issued with a list of audiences and thereby be issued to multiple APIs defined in FoxIDs as OAuth 2.0 resources.
Change the claims the down-party pass on with claim transforms.
Resource Owner Password Credentials Grant
Resource Owner Password Credentials Grant is not supported for security reasons because it is insecure and should not be used.
Client secrets
It is important to store client secrets securely, therefor client secrets are hashed with the same hash algorithm as passwords. If the secret is more than 20 character (which it should be) the first 3 characters is saved as information and is shown for each secret in FoxIDs Control.