2cwrj (2cwrj) asked a question.
When using client credential flow, having recieved a token, how should we decide if we should authorize the request?
For machine to machine communication, assuming we are using the client credential flow and have received an access token in the resource server, how should we decide whether to authorize the request.
Possibilities appear to be:
- Compare the client application id value received in the "sub" claim to a list of authorized client IDs.
- Assign a custom scope to an authorization server and feed into an access token via an authorization policy assigned to the client application.
Hi Gereth,
As more information needs to be received for a better understanding of the achievement and environment, opening a support case will be, in this situation, necessary.