1
votes

I am reading about OAuth 2 and i found the following article that help to decide which grant should i implement.

https://oauth2.thephpleague.com/authorization-server/which-grant/

I have some questions about the flow chart described in the link.

1) When the access token owner is a machine ? If the access token owner is a cron job running in a server, can i say that the access token owner is a machine ?

2) When then access token is an user ? If the client user is a human (end user), can i say that the access token owner is a user ?

3) What is exactly a Web App ? Is an application running on a server and accesed via a web client ? For example, a PHP application.

4) What is exactly a User Agent Based App ? Is an application developed using JS like an Angular app ?

Thanks.

1

1 Answers

0
votes

I went through the mentioned documentation and below I have tried to map original grant types defined in OAuth 2.0 specification against it.

1) When the access token owner is a machine ? If the access token owner is a cron job running in a server, can i say that the access token owner is a machine ?

Here, token is not necessarily issued to and belongs to a machine. It could be an application which runs on a machine which does not have end user interaction but require OAuth 2.0 tokens. As you said it could be a cron job with OAuth 2.0 client credentials. This client must be a confidential client, which means it must have a client id and a password. More can be read from here

2) When then access token is an user ? If the client user is a human (end user), can i say that the access token owner is a user ?

Yes this is correct. Here access token is owned by the end user. And end user grant client application to access OAuth 2.0 resources by letting the client use the access token.

3) What is exactly a Web App ? Is an application running on a server and accesed via a web client ? For example, a PHP application.

A web app according to the diagrams perspective is one that could utilise a user agent (browser) to complete authorization request and have a back-end capable of obtaining token. Emphasis is given to back-end token request as not all application can perform this. Foe example a single page application without a back-end cannot perform this call. So if the PHP app can perform the back-end call, then yes it is a Web app. Flow is authorization code flow.

4) What is exactly a User Agent Based App ? Is an application developed using JS like an Angular app ?

Yes this is correct. It doesn't have a back-end (it may consume one) but rely on JS and runs on browser. So it will mostly use implicit flow (but if end user trust then end user password grant as shown there)