oauth - Java OAuth2 Provider Implementation | Custom Errors -


i have searched high , low answer question , i'm reaching out community.

  • i'm trying build oauth2 access token endpoint in java.
  • i'll implementing resource owner credentials grant type return access token. (specifying end-user's username/password access token)
  • during authentication of user credentials, number of rules prevent user having access web service, such user account being locked.
  • the oauth2 rfc says errors must returned follows:
    { "error":"invalid_request", "error_description":"description", "error_uri":"some_link" }
  • it's understanding oauth spec lists standard error codes , should avoid custom error codes in response, {"error":"account_locked"}; however, i've seen api providers this.
  • i need clients of api able read error code in response know when account locked. (or other specific scenarios)

    now questions are:
  • does here have experience suggest how should scenario implemented?
  • should implement custom error codes?
  • should forget oauth2 spec , build /token endpoint same thing: authenticates user, generates token, , returns api's standard error response?

  1. i don't have same senario. won't use custom error codes since violates oauth2. instead, may consider using "error_description" error-code field in case; or can add biz_error_code field.

  2. yes, can forget oauth2, not flexible in terms of http status code , error_code. end building similar oauth2's 'password' grant_type, such access token , refresh token.


Comments

Popular posts from this blog

java - Date formats difference between yyyy-MM-dd'T'HH:mm:ss and yyyy-MM-dd'T'HH:mm:ssXXX -

c# - Get rid of xmlns attribute when adding node to existing xml -