cory.schwartz
I'm learning a lot and trying to wrap my head around everything in casdoor. I just want to verify my understanding. Typically Oauth deals with 3rd party authorization where after user authentication the "client" gets an access token with a limited scope and a "resource server" verifies that it has the access token is appropirate. The "access token" does not convey any information about the user. It's analogous to a key card at a hotel. The keycard lets you in the door, but it doesn't know who you are. Although casbin supports oauth+OIDC login, I don't understand how it supports the regular oauth model.
For example, in the casdoor UI, I see that we can create "Applications" which seem to be an oauth "client". It looks like I can facilitate Oauth+OIDC login, and then the client can apply casbin-style policies using it's model+policy framework. But if I wanted to implement an oauth resource server and have casdoor issue Access Tokens to a 3rd party client, I don't understand how I would do that.
So my thinking is that casdoor *only * supports the oauth+OIDC login, and then resource access is based on the user's identity, with the Casbin policy model. Is my understanding correct?
^^ Regarding this bug, I'm back at it this morning. To fix this problem for myself, I copied the conf/app.conf out of the container, and edited it to specifically set the origin and originFrontend ```origin = "http://localhost:8000"
originFrontend = "http://localhost:8000"
This is a bug for the casdoor all-in-one docker image. We appear to have an incorrect authorization_endpoint (7001 vs 8000) on the OIDC auto discovery. ```ᐅ curl -s localhost:8000/.well-known/openid-configuration | head
{
"issuer": "http://localhost:8000",
"authorization_endpoint": "http://localhost:7001/login/oauth/authorize",
"token_endpoint": "http://localhost:8000/api/login/oauth/access_token",
"userinfo_endpoint": "http://localhost:8000/api/userinfo",
"jwks_uri": "http://localhost:8000/.well-known/jwks",
"introspection_endpoint": "http://localhost:8000/api/login/oauth/introspect",
"response_types_supported": [
"code",
"token",
Never mind, this bug is for cadoor
