django-oidc-provider
django-oidc-provider copied to clipboard
Make Resource Owner Password Credentials Grant an option per client
I have a use case where I'd like to use my oidc server with both trusted and untrusted clients, it would be great to have a way to set the grant per client.
Also, if I understand correctly the RFC, in https://tools.ietf.org/html/rfc6749#section-4.3.2 it mentions that confidential clients should be authenticated in order to get the token in behalf of the user, strangely enough, it doesn't forbid the flow if the client is public.
So, would it be wise to at least have options to enable/disable the grant based on the client?