<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>Hi Fahmi,</div>
<div><br>
</div>
<div>I no longer work with OpenID Connect, so unfortunately I cannot answer your questions. I’d suggest that you visit <a href="https://kit.mit.edu/projects/mitreid-connect">https://kit.mit.edu/projects/mitreid-connect</a> and send this email to mitreid-connect@mit.edu
as that group maintains this codebase now. </div>
<div><br>
</div>
<div>Best regards,</div>
<div><br>
</div>
<div>—Amanda</div>
<div><br>
</div>
<div>
<div>
<div id="MAC_OUTLOOK_SIGNATURE">
<div>
<div>
<div>------------------------</div>
<div>
<div>Amanda Anganes | 781-271-3103 | <a href="mailto:aanganes@mitre.org" style="color: purple;">aanganes@mitre.org</a></div>
<div>The MITRE Corporation | K83C: Collaboration & Social Computing</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:12pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Bedoui Fahmi <<a href="mailto:bedoui@trusttic.com">bedoui@trusttic.com</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, April 6, 2016 at 12:40 PM<br>
<span style="font-weight:bold">To: </span>Amanda Anganes <<a href="mailto:aanganes@mitre.org">aanganes@mitre.org</a>><br>
<span style="font-weight:bold">Subject: </span>Open ID Connect<br>
</div>
<div><br>
</div>
<div>
<div text="#000000" bgcolor="#FFFFFF"><br>
<div class="moz-forward-container">Hello,<br>
<br>
We have questions about some theoretical issues on Open ID Connect to make sure we correctly use the mechanism, thank you very much to answer our questions<br>
<br>
We have defined our: <br>
<ul>
<li>Resource owner (<b>STATELESS</b> backend server), </li><li>Authorization server using connect2id with the mode "Resource Owner Password Credentials"
</li><li>Client app (angularjs client)<br>
</li></ul>
<br>
1/ The client receive two JWT token: <b>access token</b> (having the user subject and the list of scopes) and
<b>ID Token. </b>So we must use the access token to communicate with the Resource owner (as contains the list of scopes) and in the server side we limited the resources access according to these scopes.<br>
And the Id token is useful only in the client side (as contains a set of claims to identify the user), never sent to the server<br>
<br>
Is this true ? or can ID Token contains scopes and be used in the bearer instead of the access token ?<br>
<br>
2/ For the client part which will have the ID Token, the validation is supposed to be made only when getting the token or with every service call to the server (then we need to save it in the local storage)? And do you recommend a good javascript lib to do
that job?<br>
<br>
3/ In the oauth2 specification, there is 4 grant types (authorization code, implicit, resource owner password credentials, client credentials) but in the Open ID Connect we found a new vision, 3 grant types, authorization code, implicit and hybrid<br>
<br>
What about using the mode "resource owner password credentials" with an OP (open id provider like c2id) ? Is this prohibited ?<br>
<br>
<pre class="moz-signature" cols="72">--
Regards,
Fahmi BEDOUI
Research & Development
TrustTIC</pre>
<br>
</div>
<br>
</div>
</div>
</span>
</body>
</html>