Clients In OAuth2 and OpenID Connect

OAuth2 and OpenID Connect both have the notion of a client. In this area, a client is any application or service that relies on the authorization server for authorization.

Clients have their own credentials. They have a client identifier and a secret that they provide to the authorization server to, well, provide proof that they are authorized to obtain or verify tokens on behalf of a user. JWT carry the client id as a way to determine which client requested the token and whether they are known to the client receiving said token, and they may be listed as the audience of a token.

An interesting authorization flow is the client credentials flow. This allow a client to obtain a token to identify itself to other services. This is different than the usual use case for OAuth2 based authorization where a service or an application acts on behalf of a user. In this case, the token is to show that the client wishes to identify and show authorization to other clients with a common authorization service.

This has some interesting consequences in an environment where services are no longer contained and protected by a common firewall. It shifts the authorization model from “you can reach me, therefore you are trustworthy” to “we trust a common third party, therefore we will trust each other” model.
{"cc_re__cc_re__cc_by_sa_3_0_en": ["st like...</a> <span>May 2</span></li> </ol> </div> <div class=by_year> <h2>By Year</h2> <ol> <li><a href=\"/2016/\">2016</a> (7)</a></li> <li><a href=\"/2014/\">2014</a> (4)</a></li> <li><a href=\"/2013/\">2013</a> (7)</a></li> <li><a href=\"/2010/\">2010</a> (2)</a></li> <li><a href=\"/2009/\">2009</a> (14)</a></li> <li><a href=\"/2008/\">2008</a> (13)</a></li> <li><a href=\"/2007/\">2007</a> (20)</a></li> </ol> </div> </div> </footer> <footer> <div class=nav-inner> <p>&copy; 2007-2017 Frederic Jean</p> <p><a rel=license href=\"https://creativecommons.org/licenses/by-sa/3.0/deed.en_US\"><img alt=\"Creative Commons License\" style=\"border-width:0\" src=\"https://i.creativecommons.org/l/by-sa/3.0/88x31.png\"/></a><span xmlns:dct=\"http://purl.org/dc/terms/\" property=\"dct:title\">Out of my mind...</span> by <a xmlns:cc=\"http://creativecommons.org/ns#\" href=\"https://fredjean.net\" property=\"cc:attributionName\" rel=\"cc:attributionURL\">Frederic Jean</a> is licensed under a <a rel=license href=\"http://creativecommons.org/licenses/by-sa/3.0/deed.en_US\">Creative Commons Attribution-ShareAlike 3", "p>&copy; 2007-2017 Frederic Jean</p> <p><a rel=license href=\"https://creativecommons.org/licenses/by-sa/3.0/deed.en_US\"><img alt=\"Creative Commons License\" style=\"border-width:0\" src=\"https://i.creativecommons.org/l/by-sa/3.0/88x31.png\"/></a><span xmlns:dct=\"http://purl.org/dc/terms/\" property=\"dct:title\">Out of my mind...</span> by <a xmlns:cc=\"http://creativecommons.org/ns#\" href=\"https://fredjean.net\" property=\"cc:attributionName\" rel=\"cc:attributionURL\">Frederic Jean</a> is licensed under a <a rel=license href=\"http://creativecommons.org/licenses/by-sa/3.0/deed.en_US\">Creative Commons Attribution-ShareAlike 3.0 Unported License</a>.</p> </div> </footer> </div> <script id=dsq-count-scr src=\"//fredjean-net.disqus.com/count.js\" async></script> <script src=\"/javascripts/all-525e2181.js\"></script> </body> </html>"]}