Support for multiple apps/project (duplicate users)

[gbkwiatt]

I was just creating my own OAuth2 server base on this repo.
Main advantage in my head was, that I can use this server for multiple projects, but with that it means usernames could be duplicates, e.g. same users for different apps.

my idea was, to store users, against clientId however on getUser we don't have clientId to fetch it by.

Is there something I am missing ? is there better way to do it currently?

Or is it even a good idea to do it at all ?

[jankapunkt]

This is up to your implementation, this package is not scoped for user management. In my projects we have an authenticated / authorized route (authorization code grant workflow) that returns the user's identity and there we fetch user by id.

Maybe you add some code snipped on how you currently retrieve your user and maybe we can make a generic solution as example for the documentation out of it.

[gbkwiatt]

All I got for fetching the user is username and password, assuming username usually is email, it won't allow multiple apps/project for same users

So I want to fetch user by username + clientId pair and make that pair unique in the table

I think it will be sufficient if you add client argument to password grant.
e.g in password-grant-type.js

return Promise.bind(this)
    .then(function() {
      return this.getUser(request, client);
    })
    .then(function(user) {
      return this.saveToken(user, client, scope);
    });

and then
PasswordGrantType.prototype.getUser = function(request, client) {
and
return promisify(this.model.getUser, 2).call(this.model, request.body.username, request.body.password, client)
This would allow to fetch user for given client.

This is just my idea, not sure if that solution is against some rules of OAuth2 ?

[jorenvandeweyer]

I think this would be a good improvement to provide the client in the getUser function. We don't break any compatibility and provide a possibility to implement a multi tenant oAuth2 solution.

getUser (username: string, password: string, client?: Client) {

}

[jankapunkt]

@jorenvandeweyer I agree but let's add this to release 5.0.0

[jorenvandeweyer]

Implemented by #256

@jankapunkt Do you think you can create a new RC?

[jankapunkt]

Of course, coming in today