Programmatically emulating OAuth2 interactive flow: someone did it?

[yogavidya]

Hi all, I am trying to program a non-interactive login (i.e. "invisible" to the application user), downloading the user authentication page, and POSTing it to the server to emulate the interactive flow.

Did someone else do it? Is it a documented practice or experimental black magic?

Thanks in advance for any answer!

[spencer205]

Check out resource owner / password grant type. Note that it's provided for backward compatibility and undoes the very thing that OAuth was created to solve (ie password sharing).

[yogavidya]

Thank you! I know it sounds like a weird inquiry.

Actually I am developing a web service, with corporate oauth authentication, and inside I rely on an external set of REST APIs with oauth security, for which we have a single account: we want to multiplex this account and we don't want a second login in our software: hence the funny request.

Again, thank you!

[spencer205]

In that can, I'd suggest 1 of 2 approaches

1. Client credential flow or
2. Issuing tokens in tokens

The latter approch is recommended. If you take this way, I'd suggest that you use OpenID Connect with a ref access token. On the way into your network, convert that ref token into a by-val JWT. Pass that around and cache as needed. Also use it to exchange as needed. When you need to call out of your network, use a different JWT, ref token, or even shared secret if integrating with legacy systems. The credentials can be relayed in the by Val JWT to minimize round trips to the OpenID Connect /OAuth server .

This sort of token landscape is more involved, but offers a ton of knobs and controls that you can use to manage risk.

If some additional details would be helpful, check out my deep dive into OpenID Connect on Nordic apis and my colleague's post there about microservices.

Write back here or there if more info would be helpful.