I am very much confused about the way OAuth authorization and authentication works in Drupal 8/9. Let me put my points first, please correct me if I am wrong.
- Authorization is when an entity proves a right to access.
- Authentication is when an entity proves an identity.
I have done the following to implement a REST API which is intended to be consumed by mobile applications (Android and iOS).
- Installed and/or enabled modules: Simple OAuth, REST UI, RESTful Web Services, Serialization.
- Created a new role for specifying the scope of simple OAuth consumer, and set required permissions.
- Created a consumer by adding RSA key pair, password and scope.
- Succeeded in getting the response from
/oauth/token
by submitting a request body containinggrant_type
,client_id
,client_secret
,username
andpassword
.
The question is, why we need to send the username
and password
, for getting the access_token
, since we are only trying to Authorize the API Request and NOT Authenticate the User?
Also, what should I do to Authorize the API request with OAuth but need to access contents without authentication? Should I create a dummy user and always send this user credentials to get access_token?
It would be very helpful if someone can explain the concept and how should one proceed.
Reference I followed: https://dev.acquia.com/blog/decoupled-drupal-authentication-oauth-20
8
tag. Since this question also applies to Drupal 8. Also additionally, it will reach those who watch tags for Drupal 8.