Reputation
561
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
2 8
Newest
 Scholar
Impact
~2k people reached

  • 0 posts edited
  • 0 helpful flags
  • 16 votes cast
Jan
29
answered API design dilemma: to REST or not to REST
Sep
28
awarded  Scholar
Sep
28
accepted Identity propagation using Azure service bus
Sep
24
answered OAuth2 ROPC vs Basic Auth for public REST APIs?
Sep
24
awarded  Commentator
Sep
24
comment Identity propagation using Azure service bus
Thanks for your answer. Are you aware of implementations flowing security tokens in the message properties? I assume producers have to take precautions that the tokens are not about to expire when writing to the service bus. Any other considerations?
Sep
24
awarded  Student
Sep
24
asked Identity propagation using Azure service bus
Sep
23
comment CQRS without using others patterns
The link now points to a Chinese site selling footware. :(
Sep
14
awarded  Critic
Sep
12
comment OAuthv2 authorization grants
@smeeb, typically your access tokens also contain authorization info (what can the user do in the application or what roles he/she is in). This would differ per application, so you'd need different access tokens. You also might have users that have access to one application, but not the other.
Sep
12
answered OAuthv2 authorization grants
Aug
28
answered Best practice to authenticate third party to a website?
Jul
29
awarded  Yearling
Jul
29
awarded  Yearling
Jul
29
comment Auth options for distributed systems
Thanks and good luck! You can always post here or on SO if you run into issues.
Jul
29
awarded  Mortarboard
Jul
29
comment Auth options for distributed systems
No worries, you're welcome. Scopes are really a mechanism to determine what a 3rd party can do in your API. For example a finance application that can only read your account balance in your bank site. But since the JWT token contains the user's name and optionally even roles, you can look up in a database what a user or user in a role is allowed to do. That's also how my company is doing it.
Jul
28
comment Auth options for distributed systems
@smeeb OAuth defines scopes to indicate what the client can do. There are a number of predefined scopes, but you can define your own (for example to call specific APIs (see tools.ietf.org/html/rfc6749#section-3.3)
Jul
28
comment Auth options for distributed systems
Depending on how you trust these clients, they are authenticated differently. Say for example that you build a mobile application for your own API, you could use the resource owner credentials grant. But if the mobile client is created by a 3rd party (some app from the app store), you would use implicit grant.