Are there security standards like OAuth and OIDC but for regular API users (not 3rd party applications)?

Veita 0
Viewed 33

I'm trying to secure an API with modern security practices (like refresh tokens with token rotation).

OAuth 2.0 is widely used, and when it comes to security I'd rather use a standard than role my own.

Is there are standard like OAuth 2.0, but for applications which do not have 3rd party consumers?

In our case, we're authenticating users via various SSO providers (Google, Facebook, etc) and registering their email with our API.

Currently we issue a token on each login with a long TTL, but I'd like to switch to a refresh token implementation.

A similar question was asked where the suggestion was to use OAuth as-is and treat the users as coming from a single application: using oauth for API without 3rd party

However, wouldn't the user have to authenticate our app to use our app? That seems counter-intuitive, so I assume I'm missing something.

Also, I'm implementing this in Spring.

Thank You!

openid-connect oauth-2.0 spring-security security
1 Answers

I'm not sure about what you mean by "not 3rd party application". Have you considered using an (OpenID) authorization-server with user identity federation features?

Such an authorization-server would be a proxy for the various identity providers: "social" ones (Google, Facebook, etc.) but also corporate ones, if needed (LDAP or plain user DB). Keycloak, for instance does that pretty well and can be easily installed along with your other services ("in house").

UI applications would be configured as regular OpenID clients, using your authorization-server as only identity (and access-tokens) provider. There are great client libs out there to handle that in the framework you use (mobile, Angular, React, etc.)

  • redirects out to the authorization-server and then back in
  • tokens refreshing
  • URIs for which an Authorization header should be attached to the requests
  • ...

Spring applications exposing the API would be configured as regular OAuth2 resource-servers, using your authorization-server as only access-token issuer.

ch4mp0
Related