Let's assume:
Angular2 Web Application => WebClient
Spring Boot REST server => WebServer
WebClient and WebServer are separate with different addresses. What I would like to do is access data from WebServer rest endpoints. I need authentication to return user sensitive data.
Use case: User register client application that sends data to WebServer. WebClient is use to configure client applications and display gathered data per user.
I checked this guide Spring Boot and Oauth, also checked few other blogs and the thing i don't quite understand is how it's supposed to work.
If I use WebServer as Oauth Resurce server then i get OAuth token using Basic Authentication, i can do it from WebClient then use returned token.
What i don't understand is how to use external authentication provider like Facebook, and how this will work in my example.
My thinking is:
- Provide cliendID and secret (facebook) for WebClient.
- WebClient logs to Facebook and gets AccessToken
- WebClient uses AccessToken to get resources from WebServer
- WebServer checks AccessToken against Facebook using same ClientID and secret as WebClient
- If OK returns resources
Is this the correct way of how to use external provider like Facebook?