Need help in understand OAuth2 workflow and choosing Grant Type

0
votes

I'm a OAuth2 naive, trying to secure Rest Services. We have an environment, where we developed Client and Server ourselves. Client is deployed on Nginx server, created using HTML, CSS and Javascript. In Javascript, using AJAX we make post requests to REST WebService. REST is deployed on Tomcat server.

Its a web application where user can login by providing his credentials (AJAX calls /login webservice and gets response). Now, to implement OAuth2, I read about it and found that the type of client determines which OAuth grant to use. In this scenario, client seems to be public and Implicit Grant Type or Resource Owner Password Credentials seems an acceptable type. I need suggestions about grant type to choose for this scenario.

Also, what would be the workflow of OAuth2 in this scenario, when it will come into play. Currently, when user clicks on login or register a REST service gets executed accordingly. Now should there be a service which gets called on page load and issues a access token or merging it along with login service.

Referred to The OAuth 2.0 Authorization Framework

1
javascriptrestoauthoauth-2.0
I think it will be "Resource Owner Password Credentials" and the access token service should be invoked when the user clicks on the login button – Saptarshi Basu

1 Answers

1
votes

You have to use something like that http://www.baeldung.com/rest-api-spring-oauth2-angularjs The only two grant type that you could use in your scenario are Implicit or Password grant, because you couldn't store safely an OAuth2 "secret_code"and also because you are either resource owner and authorization server owner.