Re:Hardcoded secrets, unverified tokens, and other common JW...
by user5994461 on Saturday June 27, 2020 @03:16PM
(#23663946)
Where are you blocked in this use case?
The easiest flow IMO: The API client needs a service account (username and password like a human). It authenticates to the OIDC server with the username/password and obtains a token. Then it can call any API service with the token.
The easiest flow IMO: The API client needs a service account (username and password like a human). It authenticates to the OIDC server with the username/password and obtains a token. Then it can call any API service with the token.
It's quite straightforward really.