我可以在 Spring Boot 中为 oauth2 在同一个项目中同时使用 grant_type=password 和 grant_type=authorization_code

Question

请让我知道，如果我使用 Alexa，那么我们的项目应该实现grant_type=authorization_code并且在使用我们自己的移动应用程序时我们需要grant_type=password ，这可能吗？

Answer 1

Yes, you can. When you store clients, you assign them the allowed grant type (eg password, authorization_code).

As an example, look at he following code:

clients.inMemory()
        .withClient("my-trusted-client")
            .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
            .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
            .scopes("read", "write", "trust")
            .secret("secret")
            .accessTokenValiditySeconds(120).//Access token is only valid for 2 minutes.
            refreshTokenValiditySeconds(600);//Refresh token is only valid for 10 minutes.
}

The my-trusted-client client can either use password or authorization code.

The snippet comes from this guide that I strongly suggest you to follow together with this one . Moreover, as a note, you should read the OAuth2 RFC . It is the best guide to understand the flow.