Does OpenID Connect support the Resource Owner Password Credentials grant?

Question

I have been using OAuth resource owner credential flow previously for authorization.

However I would now like to consider using openid connect in pace of this, for authentication and authorization, and was wondering if the resource owner credential flow is supported in openid connect.

Answer 1

Yes, OpenID Connect supports all OAuth 2.0 grant types including Resource Owner Password Credentials Grant and Client Credentials Grant.

As we know, Authorization Code Grant and Implicit Grant are typical 3-legged flows including interaction between a client, an authorization server and a user. While the Resource Owner Password Credential Grant and Client Credential Grant are 2-legged which means the client uses pre-authorized scopes so that no interaction with the user is necessary, removing the need to perform one of the legs in the typical flow.

Here is a reference: Configuring an OpenID Connect Provider to enable 2-legged OAuth requests

Answer 2

The answer is YES. It is not explicit in the specification but OpenID Connect supports all OAuth 2.0 flows since it is an extension of OAuth 2.0.

The spec talks about the flows that involve browser redirect as they are more common, more secure and less brittle given that resource owner credentials only supports username and password and is only in the OAuth 2 spec for backwards compatibility.

In true SSO systems you'd want to abstract away from the method of authenticating the user at the OP/IDP. Involving a browser is a way to do that. In the Resource Owner Password Credentials flow the client "sees" the username/password of the Resource Owner unlike the other flows, which defeats the primary purpose of a federated SSO protocol like OpenID Connect where authentication mechanisms and credentials should be independent from the client/app. For that reason you won't see much use of ROPC in OpenID Connect, with an exception perhaps in intra-enterprise use cases.

But your mileage may vary wrt. support in specific OP/AS software and client libraries.

Answer 3

Yes. I also was finding answer for same question sometimes back. According to the OpenId Connect specification, It is recommended to use authorization code and implicit grant types for OpenId Connect requests. But it is not mentioned that other grant types can not be used. Therefore you can use any other grant types for OpenId Connect authentication request. There is some mail from the openid connect group, which has been discussed on this. Please find it from here. If your OAuth2 Authorization server supports it, I guess that it is fine to use it. As i know, most of the Authorization servers support it, as an example from here