Closed Guichaguri closed 3 years ago
I just found https://github.com/thephpleague/oauth2-server/issues/879 that leans towards the first solution, but since this central server is a SPA that also consumes the API, I still have to generate a token at some point.
What I mean is that I'm generating two distinct tokens for the exact same task, while also maintaining two systems for validating these distinct tokens, that's why I'm leaning towards the Laravel Passport solution.
Perhaps the AuthorizationServer class should have a generateAccessToken
function that allows to manually create an access token from a client, scopes and user identifier?
OAuth is a delegated authorisation service, not an authentication service. If you need authentication such as single sign on, you'd be better served looking at Open ID Connect.
If authorisation is what you require, I would recommend the internal users have a different login mechanism as you've outline in step 1.
Thanks for the quick answer. I've read a little bit of the OpenID Connect spec, I can see how it helps with SSO, but it's not exactly what I'm aiming for.
I already have the authentication system in place, the only missing piece is the token generation/validation for the login form. I'll be using the first solution, creating a different type of token just for the login screen.
I still think exposing functions to manually create tokens without an http request would be a good idea, so extending from the authorization system would be way less hacky.
I already have a service that has its own simple authentication system and user database. I'm implementing OAuth2 for Single Sign On for a few other external platforms.
Because of that, I'm revisiting and willing to rewrite the authentication mechanism.
The authentication on the external platforms seems pretty straight forward with OAuth2, but I'm puzzled on how should I implement the login sessions on the central server (which is also the one that serves OAuth2)
I see two solutions:
None of these solutions seem to solve the issue in an elegant way.
What is the best practice for this scenario? Is there a third solution that I'm not aware?