Understanding OAuth2 flow

Question

I'm developing an Android app that consumes a REST service that uses OAuth protocol. In the first activity, app shows a login screen. This is the flow:

1) User puts her username and password.

2) App makes a request to REST service, providing username and password.

3) REST service check the credentials and if are correct, ask for an access_token to my OAuth2 provider server.

4) REST service answers to the app providing the access_token and the refresh_token

5) In the next requests to the REST server (to get data like people, articles...) app will provide the access_token and the refresh_token.

6) When REST service process a request, will validate the access_token (using an token info endpoint of my OAuth server).

7) If the access_token is correct and has not expired, REST service will return the data that the app were asking for.

When REST service detects that access_token has expired, asks for another with using the refresh_roken.

Now, my questions:

When REST service retrieve a new access_token after the old one expires, has the REST service send it to the app in that response?

If so, has the app check, in each request/response, if new a new access_token has been sent from the REST service?

I don't know if I'm in the right way, I'm trying to understand the flow.

Thanks.

Answer 1

Assuming there's no browser involved and the app (aka. Client) uses what is called the Resource Owner Password Credentials grant, the flow is:

1. the User (aka. Resource Owner) provides his/her username and password to the Client

2. the Client makes a Token Request to the Authorization Server, providing username and password

3. the Authorization Server checks the credentials and if they are correct, it provides an access token and optionally a refresh token to the Client in the response

4. in the requests to the REST server (to get data like people, articles...) the Client will provide the access token

5. when the REST service process a request, it will validate the access token calling the token validation endpoint of the Authorization Server or by validating the token locally (e.g. if the access token is a JWT).

6. if the access token is correct, has not expired and has the right permissions (aka. "scopes"), the REST service will return the data that the Client was asking for

7. when the Client detects that access_token has expired (e.g. because the REST server returns an error), it asks the Authorization Server for another access token using the refresh token using the so-called Refresh Token grant/flow