OIDC、OAuth2.0 和 OAuth 客户端应用程序和资源服务器没有不同时访问令牌的作用

Question

I am working on the ASP.NET MVC 5 web application. It has only one layer which contains views as well as business logic/operations. Business logic is logically separated from UI but it is not behind a separate web service/API layer.

Now when I use OIDC and OAuth2.0 for my application, there is no separate Resource Server , so to say. Because Client itself has all the Resources I want to have access to.

I am using Authorization Code Flow for authentication & authorization.

Questions:

1. Does access token have any role in this case? If yes, what?
2. How am I going to practically use the access token? Since the client itself is the resource server, there is nothing to which I need to send access token to.

Answer 1

I guess you get an ID token which contains all the information you need for authentication of a user. If not, you can use the access token to get the user info. If this is all the information you need, then the access token is not needed anymore. This happens, because OAuth2 is a permission delegation protocol, not an authentication protocol in a first place.

When you have the user info, you can implement between the browser and your ASP.NET backend in any way. You can take a look at the OAuth 2.0 for Browser-Based Apps RFC .

Answer 2

In this case you should use Client Credential flow instead of Authorization Code flow. In Client Credential flow, your application would send your client id & client secret to Authorization Endpoint directly and asking for access token. Authorization Code is not needed in Client Credential flow. Details as below

1. An authorization code flow typically need your client redirect resource owner to authorization endpoint and get a authorization code from authorization endpoint, client than uses this code to get access token, at the end of the day client uses access token to access protected resource.
2. In Client Crendential flow. your client app is actually the owner of your resource. So no need to asking for a authorization code. direct uses its own client credential to get access token from authorization endpoint and use that access token to access protected resource(Resource server)