Reputation
444
Top tag
Next privilege 500 Rep.
Access review queues
Badges
2 4
Newest
 Yearling
Impact
~107 people reached

  • 0 posts edited
  • 0 helpful flags
  • 8 votes cast
17h
awarded  Yearling
17h
awarded  Yearling
17h
comment Auth options for distributed systems
Thanks and good luck! You can always post here or on SO if you run into issues.
18h
awarded  Mortarboard
18h
comment Auth options for distributed systems
No worries, you're welcome. Scopes are really a mechanism to determine what a 3rd party can do in your API. For example a finance application that can only read your account balance in your bank site. But since the JWT token contains the user's name and optionally even roles, you can look up in a database what a user or user in a role is allowed to do. That's also how my company is doing it.
1d
comment Auth options for distributed systems
@smeeb OAuth defines scopes to indicate what the client can do. There are a number of predefined scopes, but you can define your own (for example to call specific APIs (see tools.ietf.org/html/rfc6749#section-3.3)
1d
comment Auth options for distributed systems
Depending on how you trust these clients, they are authenticated differently. Say for example that you build a mobile application for your own API, you could use the resource owner credentials grant. But if the mobile client is created by a 3rd party (some app from the app store), you would use implicit grant.
2d
revised Auth options for distributed systems
added 304 characters in body
2d
answered Auth options for distributed systems
May
8
answered Why Should I Avoid Inline Scripting?
Dec
11
awarded  Teacher
Dec
11
answered Best approach for storing huge data
Nov
8
awarded  Editor
Jan
5
awarded  Supporter