REST API OAuth Authorization and Authentication

Question

I am very much confused about the way OAuth authorization and authentication works in Drupal 8/9. Let me put my points first, please correct me if I am wrong.

• Authorization is when an entity proves a right to access.
• Authentication is when an entity proves an identity.

I have done the following to implement a REST API which is intended to be consumed by mobile applications (Android and iOS).

• Installed and/or enabled modules: Simple OAuth, REST UI, RESTful Web Services, Serialization.
• Created a new role for specifying the scope of simple OAuth consumer, and set required permissions.
• Created a consumer by adding RSA key pair, password and scope.
• Succeeded in getting the response from /oauth/token by submitting a request body containing grant_type, client_id, client_secret, username and password.

The question is, why we need to send the username and password, for getting the access_token, since we are only trying to Authorize the API Request and NOT Authenticate the User?

Also, what should I do to Authorize the API request with OAuth but need to access contents without authentication? Should I create a dummy user and always send this user credentials to get access_token?

It would be very helpful if someone can explain the concept and how should one proceed.

Reference I followed: https://dev.acquia.com/blog/decoupled-drupal-authentication-oauth-20

Answer 1

Actually, I got the solution. It was my mistake, that I was trying to use OAuth2 3-legged authorization, but I am actually need OAuth 2-legged authorization.

More Details on oAuth Flow and Grant Types: oAuth Grant Types