django-oidc-provider icon indicating copy to clipboard operation
django-oidc-provider copied to clipboard

Make Resource Owner Password Credentials Grant an option per client

Open dedsm opened this issue 6 years ago • 0 comments

I have a use case where I'd like to use my oidc server with both trusted and untrusted clients, it would be great to have a way to set the grant per client.

Also, if I understand correctly the RFC, in https://tools.ietf.org/html/rfc6749#section-4.3.2 it mentions that confidential clients should be authenticated in order to get the token in behalf of the user, strangely enough, it doesn't forbid the flow if the client is public.

So, would it be wise to at least have options to enable/disable the grant based on the client?

dedsm avatar Apr 09 '18 12:04 dedsm