Skip to content

Commit db4c370

Browse files
karolrom-thaleskarolrom-thales
committed
SAAS-1193 add additional ROPC page
1 parent 1d77c87 commit db4c370

File tree

4 files changed

+41
-6
lines changed

4 files changed

+41
-6
lines changed

‎docs/products/access/api-reference/description-oauth-endpoint.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@ this flow.
3535
* The client credentials flow returns an access token that gives access to resources for a specific client. For example, when the user requests the general
3636
terms and conditions document, the resource server needs to know which client requests access to this document. The resource server does not need to know on
3737
behalf of which user the client requests access. Obtaining the access token can be automated and does not require user interaction.
38+
* The Resource Owner Password Credentials (ROPC) is deprecated and is no longer considered secure for most scenarios. See the topic
39+
on [Resource owner password credentials](../topics/web-clients/resource-owner-password-credentials.md) for more information.
3840

3941
## Authorization endpoint
4042
The authorization endpoint is used in the authorization code flow. In this flow, the

‎docs/products/access/topics/web-clients/resource-owner-password-credentials.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Resource Owner Password Credentials
2+
3+
!!! Warning
4+
The Resource Owner Password Credentials (ROPC) is deprecated and is no longer considered secure for most scenarios. It directly handles
5+
usernames and passwords, which could increase the risk of security vulnerabilities. We strongly recommend migrating
6+
to [Custom Registration](../custom-registration/index.md) flows, which provide enhanced security features and better align with
7+
current best practices in identity management. Additionally, it's imperative to restrict the use of the ROPC flow solely to private
8+
clients capable of securely holding a secret. Failure to protect this secret renders the token endpoint vulnerable to credential
9+
stuffing attacks.
10+
11+
The `Resource owner password credentials` grant type cannot be chosen when either `Authorization code` or `Device code` is configured and
12+
vice versa.
13+
14+
Features that require user interaction via the browser are not supported for web clients using the ROPC. So for example consent
15+
and additional user authentication (SMS) are not available.
16+
17+
The ROPC feature works in combination
18+
with [SAML ECP PAOS binding](https://docs.oasis-open.org/security/saml/Post2.0/saml-ecp/v2.0/cs01/saml-ecp-v2.0-cs01.pdf). Therefore a web
19+
client using this feature should have
20+
a [SAML identity provider configured](../general-app-config/identity-providers/identity-providers.md#configure-a-saml-identity-provider).
21+
The configured SAML identity provider requires a single sign on service with a `urn:oasis:names:tc:SAML:2.0:bindings:SOAP` binding in its
22+
metadata. Attribute mappings of the identity provider will be used to set the user id and other user properties.
23+
24+
The [RFC](https://tools.ietf.org/html/rfc6749#section-4.3.2) specifies that the authorization server should protect against brute force
25+
attacks. For this protection the OneWelcome Access relies on the used identity provider.
26+
27+
When a [scope verification service](../integration-extension/scope-verification/scope-verification.md) is configured, requested scopes will
28+
be verified. In case of a verification failure a `400 Bad request` response with `unauthorized_user` error is returned. This error response
29+
contains a `error_uri` field containing the scope validation failed uri configured for this [scope](../general-app-config/scopes/scopes.md).
30+
31+
32+
For other error responses please refer to the [RFC](https://tools.ietf.org/html/rfc6749#section-4.3).

‎docs/products/access/topics/web-clients/web-client-configuration.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -67,12 +67,12 @@ config: [OpenID Relying Party configuration](../oidc/configuration/configuratio
6767

6868
Grant types can be configured for a web client.
6969

70-
| Grant type | Description |
71-
|-------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
72-
| Authorization code | Specifies whether the OAuth client can use the OAuth authorization code grant type in order to allow this web client to request an access token on behalf of the end-user. This is the only grant type that is allowed for public clients using PKCE as authentication method. |
73-
| Client credentials | Specifies whether a web client can use its client credentials to request an access token. Note that this access token is not linked to a user since it's solely requested by the web client without any user interaction. This function is typically used for machine-to-machine communication. |
74-
| Device code | Specifies whether a web client can use the OAuth Device Code Flow in order to allow this web client to request an access token on behalf of the end-user. This grant type is used for devices that do not have a browser or have limited input capabilities. |
75-
| Resource owner password credentials | Specifies whether a web client can use the OAuth Resource Owner Password Credentials grant type in order to allow this web client to request an access token on behalf of the end-user. This grant type is not recommended and should be avoided if possible. |
70+
| Grant type | Description |
71+
|-------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
72+
| Authorization code | Specifies whether the OAuth client can use the OAuth authorization code grant type in order to allow this web client to request an access token on behalf of the end-user. This is the only grant type that is allowed for public clients using PKCE as authentication method. |
73+
| Client credentials | Specifies whether a web client can use its client credentials to request an access token. Note that this access token is not linked to a user since it's solely requested by the web client without any user interaction. This function is typically used for machine-to-machine communication. |
74+
| Device code | Specifies whether a web client can use the OAuth Device Code Flow in order to allow this web client to request an access token on behalf of the end-user. This grant type is used for devices that do not have a browser or have limited input capabilities. |
75+
| Resource owner password credentials | Specifies whether a web client can use the OAuth Resource Owner Password Credentials grant type in order to allow this web client to request an access token on behalf of the end-user. This grant type is not recommended and should be avoided if possible. See the topic on [Resource owner password credentials](resource-owner-password-credentials.md) for more information. |
7676

7777
## Removing a web client
7878

‎mkdocs.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ nav:
7676
- 'Web clients':
7777
- 'Introduction': products/access/topics/web-clients/index.md
7878
- 'Web client configuration': products/access/topics/web-clients/web-client-configuration.md
79+
- 'Resource Owner Password Credentials': products/access/topics/web-clients/resource-owner-password-credentials.md
7980
- 'Tokens':
8081
- 'Introduction': products/access/topics/tokens/index.md
8182
- 'Access Token': products/access/topics/tokens/access-token.md

0 commit comments

Comments
 (0)