-
Notifications
You must be signed in to change notification settings - Fork 26
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
how to set user tokens #104
Comments
This library is implementing OpenID connect. The tokens have to be a response from the respective OpenID connect provider (OAuth 2.0 authorization server). |
Yes, those tokens are generated from the Identity Server, securely, generated via the backend (aspnet) in this case, rather than nuxt UI. There is a machine to machine flow set up, and a token is requested on behalf of this anon user. This returns the token and refresh token which previously in nuxt 2 was able to link into the auth configuration. If there is no way to add this token into the existing repository (even if I just added to local storage or wherever you store them) I can still save the token myself and if your composable does not think there is a real user, then check for this fake anon user (with a real valid token) Any further thoughts (and thanks for getting back so quickly) |
The problem is that this libraries focus is the Authorization Code Flow in a confidential client scenario. The tokens that you describe should never be exposed to a client. Please share additional insights if I got your setup or use case wrong :) |
I did get the feeling it was focused around the single flow. You are mostly correct in your scenario, but let me clarify both login streams:
So the token is not the M2M token, this remains on the server as true M2M between the IDP and c# server. Effectively, if I can store the tokens, as if they had done an interactive login, then the issue is solved. when the nuxt app is requesting the token from the nuxt-oidc-auth component, it would have the token there and no other code would need to change. My only other option, would be to have 2 mechanisms, and add a custom header with an anonymous token. This is not ideal, because all the end points are currently secured with the claims in the user token (currently obtained by the OIDC or by this password credential login mechanims - anon users). so there would be a fair amount to change. I assumed there would be some way to store the tokens, and will have a look at the file you suggested - thanks. Hope that clarified the scenario and maybe there was a better way to handle anonymous (but not really anonymous!) user scenarios. |
In the nuxt auth module (https://auth.nuxtjs.org/api/auth/#setusertokentoken-refreshtoken) there was the ability to set tokens. How can this be done using nuxt-oidc-auth please?
We have a token generated for a "anon" user, but one who has validated themselves, so not just ANYONE. Previously, I just set the token to "log them in" as this anon user, without the login mechanism. My alternative would be to manage which auth store I use. this module, or retrieve token from local storage and use that. Advantage with the first was it would handle refreshes etc as part of the built in framework.
Any pointers please?
The text was updated successfully, but these errors were encountered: