Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

client credentials flow available? #67

Open
thedarkside opened this issue Dec 27, 2016 · 0 comments
Open

client credentials flow available? #67

thedarkside opened this issue Dec 27, 2016 · 0 comments

Comments

@thedarkside
Copy link

thedarkside commented Dec 27, 2016

The client credentials flow only authenticates the client application without a user role. So basically there is a valid doorkeeper_access_token but no resource_owner.
The configuration looks like this:

  config.define_resource_owner do
    Customer.find(doorkeeper_access_token.resource_owner_id) if doorkeeper_access_token&.resource_owner_id
  end

So you need to check if a resource_owner_id is set.
It works this way but i think there should be a way to declare this on each endpoint so wine_bouncer can validate it before the endpoint is called.
I think a scope is not the right way to solve this because scopes are something user role related.
Another thing to be aware of is an authenticated user has already implicitly authenticated the application too. So it feels like it's some kind of a security leveling.
Maybe a second method like oauth2_client?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant