Oauth2-server: One client per user?

[delboy1978uk]

Hi there, and thanks once again for your awesome package.

Quick question. I added a user ID column to my clients table, my thinking being that a user can create an API key, and it creates the client. So far so good, with the client_credentials grant at least.

However, I'm now on an iPhone app, and have read that as these devices are not confidential, we should not have the client secret in the source code, and instead should call a register device endpoint which will return the client details that the phone can store.

However, that has caused me a chicken and egg situation, as i need a user ID for my client now! (-_-)

So, can I ask how you have handled this?

Should I make the user column nullable, and use it only with client_credentials? Or get rid of it altogether?

Thanks in advance for any advice!

[simonhamp]

You probably don’t want to create a new client for every user.

Is this _your_ iPhone app, that you’re planning to allow _your_ users to authenticate with _your_ OAuth service?

[delboy1978uk]

Yes it is, I got my server rocking and so have moved on to some SwiftUI so that I can put it to use! :-)

[simonhamp]

So you really only need one client as this is just one client application.

Each user authenticates via that client, the authentication issues a temporary token which allows the app to act on behalf of the user.

Your client ID and secret will have to be in your source code somewhere, but usually in some kind of encrypted keystore that should protect them on each user’s device. I’m no iOS dev, but I believe it’s the Keychain there?

The client ID and secret are then only part of the process - in order to generate access tokens, the user must use a valid username and password from a valid client application using the auth code or password grants.

You shouldn’t try to circumnavigate this process with anything that muddies a client with a user.

[Sephster]

I don't think you should tie your client to your user. These are two distinct concepts in OAuth and a client will typically have many users. I would recommend that you keep these separate if possible. You should still be able to retrieve the associated user ID from the access token.

For the iPhone, you will need to use the auth code flow with PKCE to maintain security. Hope this helps!