OAuth Server (authservice) - GiteshDalal/serve GitHub Wiki

Authservice supports OAuth2 authentication and by default it's being used by all of the Serve framework microservices to authenticate requests.

Following grant types are supported:

• authorization_code
• refresh_token
• password

Depends on MySql, Vault, discoveryservice and configservice

Open http://localhost:8090 in browser to verify authservice is running

Grant Types

authorization_code (Recommended)

1. Client sends request to authservice

curl --location --request GET "http://localhost:8090/oauth/authorize?client_id=client_user&state=200&redirect_uri=http://localhost:1234/api&response_mode=query&response_type=code" \
  --data ""

2. authservice checks if user is logged in, if not then asks user to login else jumps to step 3

3. User is shown the list of scopes/access rights that client is requesting authorization for. User is given the option to make changes to allowed scopes if needed

4. authservice redirects with a code to the redirect_uri

5. Client requests for access_token and refresh_token from authservice using the code from previous step

curl -u CLIENT_ID:PASSWORD --location --request POST "http://localhost:8090/oauth/token" \
  --header "Content-Type: application/x-www-form-urlencoded" \
  --data "grant_type=authorization_code&code=CODE_FROM_STEP_4&redirect_uri=http%3A//localhost%3A1234/api"

refresh_token (Recommended)

1. Client uses access_token as Bearer in all requests to other microservices. If access_token expires, new one can be requested using refresh_token from authservice

curl -u CLIENT_ID:PASSWORD --location --request POST "http://localhost:8090/oauth/token" \
  --header "Content-Type: application/x-www-form-urlencoded" \
  --data "grant_type=refresh_token&refresh_token=REFRESH_TOKEN_GOES_HERE"

password (Not Recommended)

1. Client sends request to authservice with user credentials

curl -u CLIENT_ID:PASSWORD --location --request GET "http://localhost:8090/oauth/token_key" \
  --data "{
  \"username\" : \"user\",
  \"password\" : \"password\"
}"

Error Pages

• Page not found

• Internal server error

• OAuth related error