What workflow of OAuth 2 should I use on my application

Question

this question is more theorical so I don't know if it should be here. I want to use OAuth2 to Authenticate my user. I was searching on google and found out that there are many workflows of OAuth 2 and I don´t know what to use.

My front-end is developed in React and my back-end is developed on java with springboot.

The users are saved on a database or on the ldap servers, depending on which the person wants to use.

My application is also a Single page app, the only time it refreshes is when the user logs out.

Thanks for your help!

Answer 1

I think you make some misunderstanding about the OAuth2. OAuth2 is an authorization protocol. If you want to develop an authentication system, it is not suitable for you.

Spring Security or Apache Shiro framework would more suit your authentication system.

If your backend system wants to authorize some permission to your client. then you can use OAuth2.For example, If anyone of your customer wants to authorize a third party service access your resource, then OAuth2 would be the best choice.

Answer 2

As Zilong has already explained, the OAuth2 is authorization protocol. But OAuth2 is not exactly specific to Java but it can also be used with React. You can use this link for sample of React + Java OAuth2. I think this is what you are looking for.

Answer 3

I'm afraid your quest is not concrete enough. But to find out what architecture and OAuth2 flow to use, take a look at OAuth 2.0 for Browser-Based Apps RFC. There are several options - you can use your SPA or its backend as an OAuth2 client. Take a look at similar SO questions such as this one .

Then, for authentication purpose, learn about OpenId Connect (OAuth2 extension) and its ID token. To get info about the user, you can either use an ID token or the user info enpoint .

Answer 4

There are 4 grant types in oAuth2 which is meant for different scenarios. Refer : Securing an existing API with our own solution

Looks like password credential is the one you are looking for.

Resource owner password credential (ROPC) : the consumer (app) make calls using the bearer token created using apikey, secret, username and password. Mostly used when you(your authorization server) already know the users(user database is handled in your own system).