Contents
Can auth server and resource server be the same?
The resource server is the OAuth 2.0 term for your API server. The resource server handles authenticated requests after the application has obtained an access token. Each of these resource servers are distinctly separate, but they all share the same authorization server.
Why have a separate auth server?
By building the authorization server as a standalone component, you can avoid sharing a database with the API servers, making it easier to scale API servers independently of the authorization server since they don’t need to share a common data store.
How to separate resource server and AUTH service?
Any general comments, advice, etc. would be awesome! von v. Your alternate scenario is probably what you want to go with: if you really really want to separate your flows out, you could try something like this: user requests authorization from auth service on behalf of service with grant_type=code
How does the resource server work in OAuth?
(D) The resource server validates the access token, and if valid, serves the request. (E) Steps (C) and (D) repeat until the access token expires. If the client knows the access token expired, it skips to step (G); otherwise, it makes another protected resource request.
How does an OAuth server authenticate a client?
(A) The client requests an access token by authenticating with the authorization server and presenting an authorization grant. (B) The authorization server authenticates the client and validates the authorization grant, and if valid, issues an access token and a refresh token.
What happens when the resource server returns an invalid token?
(F) Since the access token is invalid, the resource server returns an invalid token error. (G) The client requests a new access token by authenticating with the authorization server and presenting the refresh token. The client authentication requirements are based on the client type and on the authorization server policies.