allow authentication per client per role

Created on 17 November 2015, about 9 years ago
Updated 10 May 2024, 7 months ago

The Oauth2-Server is pretty usefull in combination with the openID connect module.
At the moment I have to set permissions for anonymous to allow usage the Oauth2-Server.

I think it would be much better to have the Oauth-Server clients showing up in the permissions and then admins can tick a checkbox to allow the previous configured client to be used with a specific role.

Think about a user on a site who can login at 3 other sites using Oauth. Admins could restrict access to another site by just removing him from a role without removing him from the 2 other sites.

Feature request
Status

Active

Version

2.0

Component

Code

Created by

🇫🇮Finland Nchase

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • 🇩🇪Germany c-logemann Frankfurt/M, Germany

    I don't believe that this will come for D7 code but this would be easy possible with custom code when Add hook to control account client access Active will be accepted.

  • 🇦🇺Australia cafuego

    This should work, but by the time you have 50 clients, the permissions form would be a 100MB page load, so there are some potential practical obstacles ;-)

    I have a similiar issue for my use case and what I've done is link a taxonomy vocabulary to my users. The taxonomy terms match sites that uses should be allowed to access. To grant access, I tag a user. To remove access, I untag them. A different vocabulary controls roles.

    To achieve that, I've written a small custom module that maps the vocabularies to custom claims in `hook_oauth2_server_user_claims_alter()`. The client side of things can then check the claims and grant access and permissions based on that.

  • 🇩🇪Germany c-logemann Frankfurt/M, Germany

    I won't suggest to organize clients with roles. In our own project we will organize clients with the upcoming module grant . And on our client projects I try to reduce roles.

Production build 0.71.5 2024