Mastering Microservices with Java - Third Edition

Resource owner password credentials grant

This flow is normally used on mobile or desktop applications. In this grant flow, only two requests are made: one for requesting an access token and another for access token verification, similar to implicit grant flow. The only difference is the resource owner's username and password are sent along with the access token request. (An implicit grant, which is normally on a browser, redirects the user to authenticate itself.) Let's find out its flow:

1. The client application (for example, Quora) sends the access token request to the resource server (for example, Facebook or Twitter) with the client ID, the resource owner's username and password, and so on. On successful parameter validation, the resource ...