fagiz (fagiz) asked a question.
When creating an oauth application, it's possible to restrict it from use in a given custom authorization server by setting up policy rules for the custom authorization server. However, there doesn't seem to be a way to prevent using the application with the "Okta org as an authorization server" - the one with urls like https://example.okta.com/oauth/v1/token, rather than https://example.okta.com/oauth/aus.../v1/token or https://example.okta.com/oauth/default/v1/token.
Is there any way to restrict this accesss? We have some applications for using password grant against test auth servers, or for client credentials grant, and it seems like these should not be useable witht he "Okta org an an authorization server". Even if that server is only for authentication as opposed to authorization, it still feels like a potential security vulnerability.
Hi Ian,
Thank you for posting on the Okta community case.
You can configure Access Policies for your Okta Authorization Server to define which Client can use the Authorization Server for authentication , the Grant Type etc.
Please find more information in the below KB's:
https://developer.okta.com/docs/guides/customize-authz-server/overview/
https://support.okta.com/help/s/article/Difference-Between-Okta-as-An-Authorization-Server-vs-Custom-Authorization-Server
If you'll have any questions or require assistance, please open a case with Okta Customer Support.
Kind regards,
Sergiu Costea
Technical Support Engineer
Okta Global Customer Care