We have standardized a method for using OAuth2.0 to retrieve the required access token (see https://osdm.io/spec/authentication/). There are some issues with this:
OAuth2.0 defines several methods for retrieving an access token:
some with an identity token as credential:
RFC7523 section 2.1 (the one currently in the standard)
RFC8693 which is token exchange, and addresses a different need
some with an id/secret pair as credential:
RFC6749 sections 2.3.1 and 4.4.2 - client_id + client_secret
RFC6749 section 1.3.3 resource owner credentials aka technical user
none of them is supported by all IDM / IAM products on the market
the one selected by benerail and mentioned in the standard (rfc7523 section 2.1) is the one with the least support in the IDM/IAM market
we should standardize on methods which are actually implementable by configuration in most if not all IDM products:
when using an Identity Token JWT as the credential, then use rfc7523 section 2.2, as this is supported by more IDM products (small difference in the JWT content, different grant type)
alternatively allow providers to support the client_id/client_secret credentials, as this is supported by most IDM products
We need to discuss this and come to a conclusion urgently.
This is related to the following other issues: #515 #491
We have standardized a method for using OAuth2.0 to retrieve the required access token (see https://osdm.io/spec/authentication/). There are some issues with this:
We need to discuss this and come to a conclusion urgently.
This is related to the following other issues: #515 #491