Re:OAuth 2.0 Security Best Current Practice
by niftich on Tuesday May 05, 2020 @06:19PM
(#23085793)
A drop-in component so your product can do what exactly?
To be an OIDC Relying Party [1]?
To be an OIDC Provider [1]?
To be an OAuth2 client [2]? Keep in mind, being an OAuth2 client is probably not useful by itself -- you'll have to program your app to deal with the resource server's specific APIs to accomplish anything, and request the appropriate scopes for the situation, based on what you're doing.
To be an OIDC Relying Party [1]?
To be an OIDC Provider [1]?
To be an OAuth2 client [2]? Keep in mind, being an OAuth2 client is probably not useful by itself -- you'll have to program your app to deal with the resource server's specific APIs to accomplish anything, and request the appropriate scopes for the situation, based on what you're doing.
[1] https://openid.net/specs/openid-connect-core-1_0.html#Termin... [2] https://tools.ietf.org/html/rfc6749#section-1.1