Search code examples
oauth-2.0openid-connectopenid-provider

Oauth2 : a Data Provider whith multiple OpenId Provider


Imagine a DataProvider secured by OAuth2. This DataProvider accepts OAuth2 tokens from multiples OpenId Provider. When a RP (Client) calls this DataProvider with an Access Token, how the DataProvider can know the DataProvider to contact to check the Access Token ?


Solution

  • It is viable to create a backend which can accept OAuth tokens from multiple issuers. For this you need a layer to filter out requests and validate access tokens. If you are from JAVA EE background think this as a filter which protects all OAuth protected endpoints (ex:- Servlets).

    Selection of authorization server (the party which issued OAuth token) can be done in several way.

    First, request sender (probably a client) can pass a hint with OAuth token to data provider. You could utilize a dedicated header for this with a prior agreement with clients and data provider (server end). For example, auth-source:azure-ad to denote OAuth token was issued by azure ad authorization server. Note that in this approach you will need to agree on supported header values as well.

    Second is to detect authorization server through issuer claim (iss claim). For this your access token must be in JWT format. As per current situation, many services issue access tokens in JWT format (ex:- Azure AD does this). JWT being a self-contained token should contain iss claim which denote the JWT issuer, the authorization server.