Doorkeeper-如果用户不是管理员，则拒绝访问令牌请求

Question

Using password-grant OAuth-2 flow, If a non-admin user requests an access token with scope: 'admin' I want to be able to reject that from happening - I'm using doorkeeper with devise.

Currently any old user can ask for any scope and by default it gets granted.

I don't see an obvious hook in doorkeeper to perform this sort of logic. Where/how should I configure this?

Answer 1

This is not currently possible with doorkeeper 3.x. You'd need to monkeypatch the OAuth::PreAuthorization class or fork the gem to add the required logic.

I had a similar need, so I made this into a config option where you can specify your own preauth class. The code is here . The doorkeeper maintainers indicated they wanted to think more about the feature .

Answer 2

Using Doorkeeper 4.xx I am checking the presence of an 'admin' scope and if the current user is admin in the Doorkeeper's initializer:

resource_owner_from_credentials do
  user = User.find_for_database_authentication(login: params[:login])
  if user&.active_for_authentication? && 
    user.valid_for_authentication? { user.valid_password? params[:password] }
      admin_scope = params[:scope]&.split&.include?('admin')
      user if admin_scope && user.admin? || !admin_scope
    end
  end
end