OAuth Server

Overview#

Blocklet Service can function as an OAuth server, supporting the standard OAuth 2.0 authorization code grant. It provides unified authentication and authorization services for third-party applications (such as Grafana). The process is similar to that of GitHub or Google's OAuth and is compatible with OpenID Connect.

Features:

• OAuth 2.0 Authorization Code Grant Flow

• Retrieving Basic User Information with OpenID Connect

• Integrates with services supporting Generic OAuth, such as Grafana
• Customizable Authorization Pages and Scope Management

 Authorization Overview#

• Users choose to log in via OAuth in third-party applications
• The application redirects the user to the local OAuth Server for authentication and authorization.
• After the user grants authorization, the OAuth Server redirects to the application with an authorization code.
• The application uses the authorization code to obtain an access token
• The application retrieves user information using the access token to complete login.

Authorization Process Details#

User Authorization#

Third-party applications will redirect users to the following URL:

Argument Description:

• client_id: The application's client ID

• redirect_uri: Callback URL; this must match the registered URL.

• scope: The requested permissions

• state: To prevent CSRF attacks, generate this value randomly.

• response_type: Must be `code

User Consent#

After the user logs in and grants authorization, the OAuth Server redirects to the `redirect_uri`, including the `code` and `state` parameters:

Token Exchange for Applications#

Retrieve an access token using the authorization code:

Returns:

Retrieve User Information#

Retrieve user information with an access token: