Resource Owner Password Grant

tags :

Grant Types or OAuth flow in OAuth2 #

Description #

• Involves the client receiving the user’s credentials to obtain an access token.
• User enters user name and password in the application, instead of in IdP or authorization server
• Earlier ,almost a decode ago, this was common
  • IM aggregators
  • fintech PFM aggregators

Use Cases #

• Legacy systems
• Trusted clients

Security #

• Less secure, risks credential exposure and phishing attacks.