我可以使用多个（access_token，refresh_token）来通过Gatekeeper在不同的客户端/设备上为同一用户提供服务吗？

Question

I'm in the process of securing a Rails api-only app, and I'd like to do so with OAuth2 (password flow) and using Doorkeeper . Ignoring the fact that I can't find sufficiently clear docs on how to do this, the use case I have in mind is one where there are multiple clients on multiple devices/platforms (eg Android, iOS, browser) and they all require a user to login. I want to be able to issue a new (access_token, refresh_token) pair for every new login, and they all should identify the user for whom the pair was created. That is, if Alice logs in through Android and iOS, and Bob through two browsers, I want a record such as

| user_id | access_token | refresh_token | client_id        |
|---------|--------------|---------------|------------------|
| Alice   | a6d7f82h3hf  | d8f6g8d0e3    | Android-h3j4k5l6 |
| Alice   | 3j4k5j3l5k3  | 1hnrbtj5kc    | iOS-j2k35h3n     |
| Bob     | 513lkhbjkf3  | rhj2345bvj    | web-43nfm23      |
| Bob     | nbv234nbv65  | cbv124cr64    | web-gc62jh4      |

(data completely made up). Can someone provide a straight answer, and possibly point me to docs, a guide, a tutorial relevant to this? I know I can roll out my own auth system implementing this particular use case, and I have done so in the past, but with this one I'd like the flexibility of OAuth2 for future improvement.

Answer 1

I'm working in something like this, and I've found this helpful link to implement a simple password strategy. With Doorkeeper you'll get a record such as:

• resource_owner_id (user id)
• application (granted application)
• token
• refresh_token
• expires_in
• revoked_at
• created_at
• scopes
• previous_refresh_token

So you can serve the same user on different applications/clients.

Now I've also some problems with Rails 5 API , because Doorkeeper uses views to grant applications. There is a similar issue #821 , I solved the problem just turning off the api mode at config/application.rb .

config.api_only = false