OAuth 2: separating resource server and authorization server

Question

The OAuth 2 spec leads me to believe that the "resource server" and "authorization server" do not necessarily have to be the same application but I'm struggling to figure out how this is actually implemented in practice.

As an example, suppose the following apps exist:

• resource server
• authorization server
• web frontend
• third-party client app

Scenario #1: Logging in to web frontend

• user submits login form
• web app POSTs credentials to auth server (grant_type=password) and receives an access_token
• the web app stores the access_token in a session
• upon each subsequent request:
  • GET resource(s) from the resource server (w/ access_token in Authorization header) and render it in the web frontend
  • if we get a 401 then log the user out (remove access_token from session)

Scenario #2: Authorizing third-party app

• user requests authorization from auth service
• allow/deny form is displayed
• user is redirected back to client app with authorization code present
• client app POSTs code to auth service (grant_type=authorization_code) and receives an access_token
• client GETs resources from the resource server passing (w/ Auth header)

The part I'm having trouble understanding is how to authenticate the user before showing the allow/deny form in scenario #2. The user may be logged into the main web app but the auth service has no idea about that and would somehow need to authenticate the user again. Does the auth service need to support login/sessions as well?

I'm wondering if it might make more sense for the web app to be responsible for showing the allow/deny form for two reasons:

1. it keeps all of the UI in a single app
2. wouldn't force the user to resubmit his or her credentials if they are already logged in to the web app

Here's one possible alternative to scenario #2:

• user requests authorization from web app
• allow/deny form is displayed
• web app POSTs to auth server creating a new grant, authorization code is returned
• web app redirects to client app with authorization code present
• client app POSTs code to auth service and receives access_token

What's the best way to handle this? Any general comments, advice, etc. would be awesome!

Thanks

Answer 1

OAauth2 framework docs : https://www.rfc-editor.org/rfc/rfc6749

(A) The client requests an access token by authenticating with the authorization server and presenting an authorization grant.

(B) The authorization server authenticates the client and validates the authorization grant, and if valid, issues an access token and a refresh token.

(C) The client makes a protected resource request to the resource server by presenting the access token.

(D) The resource server validates the access token, and if valid, serves the request.

(E) Steps (C) and (D) repeat until the access token expires. If the client knows the access token expired, it skips to step (G); otherwise, it makes another protected resource request.

(F) Since the access token is invalid, the resource server returns an invalid token error.

(G) The client requests a new access token by authenticating with the authorization server and presenting the refresh token. The client authentication requirements are based on the client type and on the authorization server policies.

(H) The authorization server authenticates the client and validates the refresh token, and if valid, issues a new access token (and, optionally, a new refresh token).