title: OAuth + spring security for internal REST communication
body: <h2>Setup</h2>
  
  <p>We're developing a distributed application with <strong>Java and Spring</strong> where our existing client front end (complete with its own authentication, database, accounts, etc.) uses <strong>REST</strong> calls to access our new server for additional services. We want to protect these resources with <strong>Oauth</strong>. </p>
  
  <p>Access should be restricted by <strong>role or account</strong>. However we don't want the user on the client side to have to worry about any additional authentication apart from the already <strong>existing account</strong>. At the same time we need to provide a means for third party applications to access some resources from the outside after going through some kind of registration against the server (which is why we're distributing in the first place).</p>
  
  <p>So we have set up <strong>spring security</strong> on the server side to provide accounts that should be used to <strong>restrict access to the resources</strong>. The <strong>user should log in on the client side</strong> and then be able to access only those <strong>server resources</strong> assigned to him. We have some kind of registration process that sets up the user on the client side to be able to access the server services so any account setup I think should be done there.</p>
  
  <h2>So the questions are</h2>
  
  <p>How can I enable the client side to obtain an access token for the protected resources without the user having to log in to his server-side account? </p>
  
  <p>And how do I setup the server side account without needing any user input? </p>
  
  <h2>My thoughts</h2>
  
  <p><strong>This won't do</strong></p>
  
  <p>I'm thinking I'll have to either tell the client about a new account created on the server side for that user (but then, how would I choose and communicate a password?) or synchronize the client side account to the server, and use those credentials to authenticate the client against the server and generate access tokens. But how save can that be? Also the server has a much higher security (one way encrypted, salted passwords) on its accounts and I don't really want to compromise this by using the less save client accounts.</p>
  
  <p><strong>Maybe this will?</strong></p>
  
  <p>Maybe the way to go will be to tell the server about the client account during the first authentication, create an account on the server side, store the generated token on the client side and then authenticate the client against the server with that token for each subsequent request..? Will the server be able to log-in the client using its server-side account via that token for each request?
  I'd need a special resource for that initial (2-legged?) handshake that can only be accessed from the client server, right?</p>
  
  <p>Also:
  Which would be better suited for the task, OAuth 1 or 2?</p>
  
  <p>I'm hoping someone understands my problem and can help me sort through possible missunderstandings and knowledge gaps (I'm reading through Oauth and spring security documentations right now, so I'll update if I come up with a clearer picture and thus clearer questions of what to do)</p>
  
  <p>Thanks for any help!</p>