consumer key/secret question about restify-oauth2

[domenic]

I think this is actually a case for the Client Credentials flow. In particular, compare the ASCII-art diagram there with the one for Resource Owner Password Credentials.

Interestingly enough, CC is very simple and is a clear subset of ROPC. So it would be pretty easy to implement as part of restify-oauth2.

Maybe the API should be that you provide either hooks.grantClientToken, for CC, or you provide hooks.validateClient and hooks.grantToken, for ROPC? What do you think of an API like that?

[rpedela]

Makes sense, and yes I like that API. Thanks for planning to add it. My only suggestion is to add something to the API which makes it clear you are using CC or ROPC, but it is a pretty simple thing to documentation as well.

[domenic]

Yes, I was wondering about that. Ideas appreciated. Here are some random ones that I'm not sure if I like:

restifyOAuth2.ropc(server, options); // hooks = existing ones
restifyOAuth2.cc(server, options);   // hooks = grantToken, authenticateToken

var options1 = {
  tokenEndpoint: "/token",
  ropcHooks: { validateClient, grantToken, authenticateToken }
};

var options2 = {
  tokenExpirationTime: 3600,
  ccHooks: { grantToken, authenticateToken }
};

[rpedela]

Functions allow you to know what the user's intentions are which is useful for checking that the right hooks were given. Also the API is clear if more flows are added in the future since the options could be very different.

[domenic]

Version 2.0.0 is now out, with support for the client-credentials flow!

[rpedela]

Awesome! Thanks.