Enable registration of OAuth2 Clients in compliance to RFC7591

[ZroMnc]

Problem Description:

Using the implicit flow is nice but that does not give you a refresh token by default. The problem to be solve is that for tool like zign the client use the secure authorization_code RFC-6749 Section 4.1 must be provisioned to each user. In doing so you are exposing the secret of the client rending the authentication towards the OAuth2.0 provider kind of useless. You can however use an access token of a user to create new client which is then bound to the employee, increasing not only the security of the refresh token out in the wild,

Note: refresh tokens are bound to a client and can only be refreshed with the proper client

but that also ties the refresh token much closer to the individual user effectively personalizing a client just for that particular user.

Process Idea

1. Install zign
2. configure zign (endpoints)
3. Request access token via client using implict flow (returns access_token)
4. Use access_token to create client supporting auth_code (returns client)
5. Zign uses config to place received client in config dir
6. Zign initiates auth_code flow by opening the browser and requesting a code
7. The returned code is used to retrieve access_token and refresh_token

Links

• https://tools.ietf.org/html/rfc7591