oauth - Java OAuth2 Provider Implementation | Custom Errors -
i have searched high , low answer question , i'm reaching out community.
- i'm trying build oauth2 access token endpoint in java.
- i'll implementing resource owner credentials grant type return access token. (specifying end-user's username/password access token)
- during authentication of user credentials, number of rules prevent user having access web service, such user account being locked.
- the oauth2 rfc says errors must returned follows:
{ "error":"invalid_request", "error_description":"description", "error_uri":"some_link" }
- it's understanding oauth spec lists standard error codes , should avoid custom
error
codes in response,{"error":"account_locked"}
; however, i've seen api providers this. - i need clients of api able read error code in response know when account locked. (or other specific scenarios)
now questions are: - does here have experience suggest how should scenario implemented?
- should implement custom error codes?
- should forget oauth2 spec , build
/token
endpoint same thing: authenticates user, generates token, , returns api's standard error response?
i don't have same senario. won't use custom error codes since violates oauth2. instead, may consider using "error_description" error-code field in case; or can add biz_error_code field.
yes, can forget oauth2, not flexible in terms of http status code , error_code. end building similar oauth2's 'password' grant_type, such access token , refresh token.
Comments
Post a Comment