Comments (13)
Yes you could just use the id_token token flow. No need to get the access_token a second time.
Greetings Damien
from angular-auth-oidc-client.
Hi @MovGP0
OpenID Implicit Flow (id_token token) => web clients which access APIs
This PR makes it possible to get the id_token (Will be merged next week when I have a PC again)
https://github.com/damienbod/angular-auth-oidc-client/pull/49/files
Why do you need the id_token?
Greetings Damien
from angular-auth-oidc-client.
@MovGP0 If you use the id_token token Implicit Flow, you will recive the access_token back.
The getToken method then returns the access token.
Greetings Damien
from angular-auth-oidc-client.
the access token I get is for the STS. But I figured out a method that works for me:
- the
Client
gets theAccess Token
and theRefresh Token
from the STS using theImplicit Flow
- the
Client
send theAccess Token
to theResource
- the
Resource
uses theIdentityEndpoint
to validate the token and get the user information - If the user has the proper role claims, the
Resource
invokes theTokenEndpoint
of the STS to get anResource Access Token
for theResource
usingCode Flow
- the
Resource Access Token
gets send to the client - the client caches the
Resource Access Token
- the client uses the
Resource Access Token
to access the protected resources (without additional round trips).
I am just wondering if there is a simpler solution...
from angular-auth-oidc-client.
well, how do I get the id_token
then? the .getToken()
method returns the STS access token, and the .getUserData()
method doesn't return the ID token either, but only its decoded variant.
Apparently, the id_token
gets saved to the storage, but doesn't get exposed by the OidcSecurityCommon
service like the access token.
from angular-auth-oidc-client.
btw: i am not fully sure what an ID Token flow is. There is
- Implicit Flow (for web clients)
- Authorization Code Flow (3-ledged OAuth flow)
- Resource Owner Password Credentials Flow
- Client Credentials Flow / Code Flow (for clients with secrets)
- Hybrid Flow (basically what I do if I understand it correctly [which might not be true], but with an additional roundtrip for checking the user roles)
sources:
- OpenID Connect Flows
- Biehl, Matthias. OAuth 2.0: Schnelleinstieg in Web-API Security (API University Series) (German Edition) (Kindle Location 209). Matthias Biehl. Kindle Edition.
from angular-auth-oidc-client.
what I need are
- User Claims in the frontend to enable and disable visible functionality;
.userData()
is fine for that. - Resource Access Tokens for the resources (there are more than one)
what I have is after the Implicit Flow is
- the User Claims (id token)
- the STS Access Token (can be used to get additional tokens from the token endpoint)
from angular-auth-oidc-client.
The access_token can be used to access the user data endpoint which has the user claims. (or userData which is the same for the id_token token flow.
The access_token is also used for the APIs
Why do you need additional tokens?
Greetings Damien
from angular-auth-oidc-client.
when accessing the API, I don't want to invoke the User Data Endpoint every time for performance reasons. So my current method is that the Resource invokes the User Data Endpoint only once and gives the Client an Ressource Access Token when the Resource Owner has the appropriate claims.
The Client can cache this Ressource Access Token and use it to access the Resource.
- The advantage is that the Ressource can validate this token without additional round trips to the UDE.
- The drawback is that I need to cache and refresh the Resource Access Tokens.
Note: the Resource can issue the Ressource Access Token himself or via the Token Endpoint from the STS. Both methods should work.
from angular-auth-oidc-client.
the problem I have with the access_token is that it is issued with
{
"aud": "sts.mydomain.com"
}
what I would need is:
{
"aud": "sts.mydomain.com",
"aud": "resource1.mydomain.com",
"aud": "resource2.mydomain.com"
}
from angular-auth-oidc-client.
You should use, scopes, or api resources claims for this.
aud
REQUIRED. Audience(s) that this ID Token is intended for. It MUST contain the OAuth 2.0 client_id of the Relying Party as an audience value. It MAY also contain identifiers for other audiences. In the general case, the aud value is an array of case-sensitive strings. In the common special case when there is one audience, the aud value MAY be a single case-sensitive string.
Here's an example:
from angular-auth-oidc-client.
But it should be possible to add multiple aud values in IdentityServer4 to the access_token so only 1 token is required.
from angular-auth-oidc-client.
I guess it is. Just haven't figured it out yet.
As I understand it, I need to do the following:
- create an API Resource for each Resource Server.
- bundle claims into Scopes that the user can allow or deny.
- add the Scopes to the appropriate API Resources
- configure UserClaims, which the ApiResource can get from the user.
- when asking for the access token handle the name of the ApiResource as a claim
- IdentityServer's
IProfileService
enriches and filters the claims for the Access Token based on the user properties - the access token should now contain all the requested ApiResource names in the audience field
from angular-auth-oidc-client.
Related Issues (20)
- [Question]: Is it possible to not validate the `code` parameters when requesting `authorize` (authorization endpoint) from the API?
- [Question]: How to build a `PartialRoutesGuard` without auto-login
- [Question]: Unable to find eagerLoadAuthWellKnownEndpoints in version 18.0.0
- [Bug]: Expected double-quoted property name in JSON at position 709 HOT 2
- [Bug]: AutoLoginPartialRoutesGuard is not trying to silentRenew if refresh token still valid HOT 2
- [Question]: How can I use urlHandler when using authorizeWithPopUp, is it supported in popup?
- [Question]: How can i use it with oidc-provider
- [Question]: Async provider loader with provideAuth HOT 3
- [Question]: Is there a handler for when the refresh token process returns id_token?
- [Question]: Angular 18 SSR
- [Bug]: Potential Infinite IFrame Creation When 'checkSessionIframe' Is undefined
- [Question]: Implementing Custom Storage in standalone api HOT 2
- [Feature Request]: Custom auth header
- [Question]: Error handling support with Azure
- [Bug]: Silent renew failed with error: invalid_grant HOT 1
- Documentation website down HOT 2
- [Bug]: Wellknown endpoints completely overwrite the authWellknownEndpoints configuration
- [Bug]: Firefox login crashes : this.cryptoService.getCrypto().subtle is undefined HOT 2
- [Bug]: Sample & Documentation site is down (404) HOT 2
- [Bug]: silentRenewTimeoutInSeconds does not timeout the token refresh http request
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from angular-auth-oidc-client.