get oauth2 token by providing username and password to backend

[vtolstov]

I'm newbie with angular2 and you angular2-oauth2 module.

I want to create login form with username and password and after user click login app send this data to my own (golang oauth2 backend, that verifies data and return some token).
What i need to do in login?

   public login() {
        this.oAuthService.initImplicitFlow();
    }

what is the initImplicitFlow ? where i can find help for module methods? Thanks!

[DavidParks8]

The idea of using oauth2 or open id connect (oidc) requires that your app not handle the authentication process directly. This is achieved by letting the security token service (STS) present a login page and perform authentication. Your app would then trust the STS and use the token(s) it returns when authentication succeeds. Oauth2 and oidc can both use what's called the implicit flow. A short explanation can be found here. You can achieve what you want by implementing the resource owner password credentials flow, but I'd highly discourage it due to potential security issues.

To get a starting understanding, please check out the first few sections of the identityserver4 documentation.

[vtolstov]

Thanks, but what is the best way to auth user of single page application that public available? 21 Янв 2017 г. 10:19 PM пользователь "David Parks" <notifications@github.com> написал:

…

The idea of using oauth2 or open id connect (oidc) requires that your app not handle the authentication process directly. This is achieved by letting the security token service (STS) present a login page and perform authentication. Your app would then trust the STS and use the token(s) it returns when authentication succeeds. Oauth2 and oidc can both use what's called the implicit flow. A short explanation can be found here <http://labs.hybris.com/2012/06/05/oauth2-the-implicit-flow-aka-as-the-client-side-flow/>. You can achieve what you want by implementing the resource owner password credentials flow, but I'd highly discourage it due to potential security issues. To get a starting understanding, please check out the first few sections of the identityserver4 documentation <https://identityserver4.readthedocs.io/en/release/intro/big_picture.html> . — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#23 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAdYG4CMLB_cfY3g3kFD59nOaspIpKXRks5rUlokgaJpZM4Lfy7r> .

[DavidParks8]

That depends on if you plan on turning your single page application into a mobile application.
Scenarios and what I believe to be the most secure oidc flow:

• Spa with identity info and no secure api calls: implicit flow
• Spa with identity info and secure api calls: hybrid flow
• Spa as mobile app with identity info and/or secure api calls: authorization code flow with proof of key for code exchance (PKCE)
• Spa with no identity info, but makes secure api calls: client credentials flow (not very secure because the secret key will be embedded in your app and visible in the browser) -you might want to lock this scenario down with more security such as enforcing CORS or keeping the key on your server somehow.

And, of course, all of these must be performed using TLS.

[TomWhiteOmni]

Hi @DavidParks8
I'm looking at trying to implement PKCE for my Ionic / Angular 5 mobile app. Have you managed to get this working with this library?
I've been hunting for some example Angular code, but no luck so far.
Regards
Tom