4. Resource Owner Password Credentials (ROPC) Flow

Overview

In the ROPC Flow, the user provides their credentials (username and password) directly to the application, which then exchanges them for an access token. This flow is only recommended for highly trusted applications, such as first-party applications.

OAuth ROPC Flow

Steps

  1. The client requests a token by calling the token endpoint.
    2. # For client authentication method set to none:
curl --location --request POST \
--url "https://$TENANT_ID.$REGION_ID.authz.cloudentity.io/$TENANT_ID/$WORKSPACE_ID/oauth2/token" \
--header "Content-Type: application/x-www-form-urlencoded" \
--data-raw "grant_type=password&client_id=$CLIENT_ID&username=$USER_NAME&password=$USER_PASSWORD"

# For client authentication method set to client secret post or basic:
curl --location --request POST \
--url "https://$TENANT_ID.$REGION_ID.authz.cloudentity.io/$TENANT_ID/$WORKSPACE_ID/oauth2/token" \
--header "Content-Type: application/x-www-form-urlencoded" \
--data-raw "grant_type=password&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&username=$USER_NAME&password=$USER_PASSWORD"
  2. Authorization server validates user credentials.
  3. Authorization server returns the access and ID tokens.
  4. User gets authenticated.

Use Case

Highly trusted applications: Suitable when the application and the resource owner have a high level of trust, such as first-party applications.

Security

5. Device Authorization Flow

Overview

The Device Authorization Flow is tailored for devices with limited input capabilities, such as smart TVs or IoT devices. The device prompts the user to visit a URL on a secondary device and enter a code to authorize access.

Steps

  1. User Code: The device requests a user code and instructs the user to visit a URL.
  2. User Authorization: The user authorizes access on a secondary device.
  3. Token Polling: The device polls the authorization server to exchange the user code for an access token.

Use Case

Devices with limited input capabilities: Suitable for smart TVs, IoT devices, or other devices where user input is limited.

Security