Duende Software
Best practice setup for website with user auth and API calling #578
|
Hi, we have a website that uses Duende IdSvr for user authorisation and also calls an API (from the server). When this website was initially setup 2 clients were created, 1 for the user auth (authosation code) and 1 for the API (client credentials). Is this best practice or would it be better to use 1 client for both? |
Replies: 1 comment
|
There is no real best practice here, it all depends on the use case. Duende IdentityServer does support combining the authorization code grant with client credentials when configuring a client, by setting the But when the machine-to-machine aspect of the solution requires significantly different scopes than the users of the client, or you want the ability to rotate the client's secret independently, then splitting up the grants into two separate client definitions makes more sense. |
There is no real best practice here, it all depends on the use case.
Duende IdentityServer does support combining the authorization code grant with client credentials when configuring a client, by setting the
AllowedGrantTypestoGrantTypes.CodeAndClientCredentials, which makes sense for clients where both users authenticate and interact with an API, as well as the client itself to perform back-channel operations.But when the machine-to-machine aspect of the solution requires significantly different scopes than the users of the client, or you want the ability to rotate the client's secret independently, then splitting up the grants into two separate client definitions makes more sense.