Support for client credentials flow about doorkeeper-openid_connect

[aisensiy]

Right now the password grant flow is better than client credential grant flow for me. So I will try to implement this later...

[toupeira]

No plans, Doorkeeper supports it but it says "The main difference from the others is that this flow is not associated with a resource owner." so I'm not sure if it even makes sense to use this flow with OIC.

[aisensiy]

I think it make sense with microservice architectures.

I'm trying to use doorkeeper-openid_connect to create a central "account management and authentication service" like keycloak, or you can think it as an open source version auth0.

And it need to integrate other microservices. The client credential way is the main method to make the other microservices themserlves authenticated as a resource owner.

And if the Doorkeeper supports it, does it mean it is easy to make it support for doorkeeper openid connect? I have little knowledge to develop a gem like this but I do have some rails working experience. So if you can give me some hint I think I can do some contribution if you like it.

[toupeira]

A PR would be welcome if you can get this working 👍

If you look at lib/doorkeeper/openid_connect/oauth/authorization_code_request.rb you can see how we extend Doorkeeper to add the ID token to the response, basically you need to do something similar for lib/doorkeeper/oauth/client_credentials_request.rb but since there doesn't seem to be a resource owner in that context I'm not sure how to proceed.

Unfortunately I don't have time to look into this, but can suggest maybe doing more research if/how other OIC providers implement this.