Multiple authentication methods required in standard

[ralfbayer-db]

We have standardized a method for using OAuth2.0 to retrieve the required access token (see https://osdm.io/spec/authentication/). There are some issues with this:

• OAuth2.0 defines several methods for retrieving an access token:
  • some with an identity token as credential:
    • RFC7523 section 2.1 (the one currently in the standard)
    • RFC7523 section 2.2
    • RFC8693 which is token exchange, and addresses a different need
  • some with an id/secret pair as credential:
    • RFC6749 sections 2.3.1 and 4.4.2 - client_id + client_secret
    • RFC6749 section 1.3.3 resource owner credentials aka technical user
• none of them is supported by all IDM / IAM products on the market
  • the one selected by benerail and mentioned in the standard (rfc7523 section 2.1) is the one with the least support in the IDM/IAM market
  • we should standardize on methods which are actually implementable by configuration in most if not all IDM products:
    • when using an Identity Token JWT as the credential, then use rfc7523 section 2.2, as this is supported by more IDM products (small difference in the JWT content, different grant type)
    • alternatively allow providers to support the client_id/client_secret credentials, as this is supported by most IDM products

We need to discuss this and come to a conclusion urgently.

This is related to the following other issues: #515 #491

[schlpbch]

Thanks Ralf!