In this video, let's try to understand the third grant that we have inside what to floor, which is
resource Warner credentials Grant.
So before going into the details, I just wanted to give a scenario where both the Observer and Resourcehouse
and client everything belongs to the same organization like my bank, which is easy bank application.
If they have multiple independent applications where they're maintaining different details like loans
cards and accounts.
But since the customer is common for all of them, they decided to implement the authentication, logic
and alteration logic in a separate overcall operations over like as an user, I'll go to the loan application
or card application or account application if I click login.
If you follow previous grant types like Autrey's grant type and implicit grant by the client will redirect
me to the Observer where I have to enter my credentials.
But that looks very peculiar to me, are annoying to me for multiple redirects because it's not making
sense.
Right?
I go to Easy Bank application and while it is redirecting me to address you are where I have to enter
credentials.
So in such scenarios where we have lots of resources, our and our clients belong to the same organization,
to our multiple redirects, and to use some good experience to the user, we don't redirect the user
to the Utsav.
So due to this reason, when our user went to some application like loan application, there'll be a
login page and again, I will not be asked like you will be related to were very happy and were because
Azzaro also belongs to the same organization.
So I enter my credentials on the loans application login page.
My client application will capture my username and password and it will send that request to the Odzala
in the back and without real direct experience to the user.
And this perfectly makes sense, right?
Because even the observer also belongs to me.
Only my organization and I can completely believe my client and utter words that they won't misuse the
user details that they result from that is so.
Swapna So for such instances, we use resources on our credentials.
Granted, let's try to see what is a flaw here.
First, the user will go to the client application and he will directly argue, Here are my credentials
in the login page.
Next, the client application.
It will send the request to one of the orzo like here at the user.
Details are resource.
Worner details.
Please validate and provide me access to one observer validated the credentials.
It will provide a token to the client and in the last two steps the client will make a request for the
resource.
So by providing the token which it received from the alteration.
So what if the token is valid?
That is also what will provide the resources requested by the client.
As you can see in the step to where we are making a request to the alteration software for generating
access token, the client has to generate a request with all the following parameters.
One is a client ID and client secret, which is belongs to the application that we are trying to login,
whether it is a loan application or cards application or account application.
So every application will have a different client alien client secret, which can be used by the Observer
to identify from which client I'm getting the requests so that we can use them for auditing purposes
as well.
Next is a scope like similar to authorities and third one is a very important one username and password.
The client itself now holds the username and password.
The reason is the client application and also where they both belong to see marginalisation due to this
reason and to avoid that real direct effect to the user, we are sharing the user name and password
that we received from the login page of the claim to the Observer directly and the last one granted
where we have to tell with the value of string password, which indicates that my application want to
follow resource Worner are user credentials granted?
Again, to reiterate this resource, one of Clinton's grant type will be used only if the claimed authorization
server and the resource servers are maintained by the same organization.
Like many organizations, they have multiple sub applications, multiple internal applications where
they will isolate all the.
And authentication logic to separate our colored observer and all these multiple applications that that
organization is maintaining, they will make a request to the server to generate a token, but they
don't redirect.
And all this will happen only in the back.
And one of the primary reason why we are using these grant types to give a better experience to the
user by avoiding multiple redirects since all these applications belong to the same organization.
With this, I'm assuming that now you have a clear understanding what is resource credentials grandpap
type what to flow in next video we will discuss about client credentials.
Granted, thank you.
And see you in the next video by.