Resource owner password credentials
Warning
The resource owner password credentials (ROPC) grant type is deprecated and are no longer considered secure for most scenarios. ROPC directly handles usernames and passwords, which could increase the risk of security vulnerabilities. We strongly recommend migrating to custom registration flows, which provide enhanced security features and better align with current best practices in identity management. Additionally, it's imperative to restrict the use of the ROPC flow solely to private clients capable of securely holding a secret. Failure to protect this secret renders the token endpoint vulnerable to credential stuffing attacks.
The resource owner password credentials grant type cannot be chosen when either the authorization code or device code type is configured and vice-versa.
Features that require user interaction via the browser are not supported for web clients using ROPC. So, for example, consent and additional user authentication methods (such as SMS) are not available.
The ROPC feature works with the SAML ECP PAOS binding and allows integration with the IDAAS-core proprietary API using the resource owner password credentials integration. Therefore, a web client using this feature has two authentication options:
-
SAML ECP PAOS Binding: The web client should be configured with a SAML identity provider in this case. The configured SAML identity provider requires a single sign-on service with the
urn:oasis:names:tc:SAML:2.0:bindings:SOAPbinding in its metadata. Attribute mappings of the identity provider are used to set the user ID and other user properties. -
IDAAS-core proprietary API: The web client can use the OneWelcome Identity Platform identity provider with the resource owner password credentials integration. This integration allows communication with the public OneWelcome Identity Platform API for authentication using the username and password for the ROPC flow.
The RFC specifies that the authorization server should protect against brute force attacks. For this protection, the OneWelcome Identity Platform relies on the identity provider that is used.
When a scope verification service is configured, the requested scopes are verified. If there is a verification failure, a 400 Bad request response with an unauthorized_user error is returned. This error response contains an error_uri field containing the scope validation failed URI configured for this scope.
For other error responses, refer to the RFC.
