Please enable JavaScript.

Coggle requires JavaScript to display documents.

Application Security using IdentityServer - Coggle Diagram

- - - - Used with no user in mind, fx. server daemon, batch job etc needs to call an API
      - Prerequites:
        
        Client defined with client credentials grant
        
        API scope defined (optionally a resource)
        
        Grant client access to scope via AllowedScope property
      - Automated token request can be set up when registering token. See IdentityModel.AspNetCore nuget package. See services.AddAccessTokenManagement
    - - Used by web apps
      - Returns all 3 types of tokens
      - Uses authorization code flow.
        
        Call authorize endpoint and let user login. A code is returned
        
        Code is used at token endpoint get get identity + access token
        
        GET /connect/authorize?client_id=client1&scope=openid api1&response_type=code&redirect_uri=https://myapp/callback&
        
        GET /callback?code=abc&scope=openid api1
      - Prerequisites:
        
        Client is defined with authorization code grant type
        
        A identity resource is defined (fx. openid)
        
        A API scope is defined (resource optionally)
        
        The client is granted access to both scopes via AllowedScopes property
    - - Access tokens have finite lifetimes. If a client needs long-lived access to a resource, refresh tokens can be used to request a new access token. This can be done with an API call and does not require any user interaction or interruption.
      - Clients needs to be explicitly authorized to be able to use refresh tokens by setting the AllowOfflineAccess property to true
      - Refresh tokens are supported for the following flows:
        
        authorization code
        
        hybrid
        
        resource owner password credential flow
      - You can request a refresh token by adding a scope called offline_access to the scope parameter list of the authorize request
      - You can request a refresh token by adding a scope called offline_access to the scope parameter list of the authorize request