{"action":"created","issue":{"url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/592","repository_url":"https://api.github.com/repos/thephpleague/oauth2-server","labels_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/592/labels{/name}","comments_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/592/comments","events_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/592/events","html_url":"https://github.com/thephpleague/oauth2-server/issues/592","id":158546548,"number":592,"title":"Does the server support multiple grant_types with one server?","user":{"login":"TommyBs","id":952238,"avatar_url":"https://avatars.githubusercontent.com/u/952238?v=3","gravatar_id":"","url":"https://api.github.com/users/TommyBs","html_url":"https://github.com/TommyBs","followers_url":"https://api.github.com/users/TommyBs/followers","following_url":"https://api.github.com/users/TommyBs/following{/other_user}","gists_url":"https://api.github.com/users/TommyBs/gists{/gist_id}","starred_url":"https://api.github.com/users/TommyBs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TommyBs/subscriptions","organizations_url":"https://api.github.com/users/TommyBs/orgs","repos_url":"https://api.github.com/users/TommyBs/repos","events_url":"https://api.github.com/users/TommyBs/events{/privacy}","received_events_url":"https://api.github.com/users/TommyBs/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-06-05T09:45:45Z","updated_at":"2016-06-22T21:04:17Z","closed_at":"2016-06-17T07:42:13Z","body":"Hi,\r\n\r\nCan I implement multiple grant types? If so how would token validation work?\r\n\r\nFor instance I have an api that might have protected resources that require a user to be validated before they can access them. Now as the Api can be used by first and 3rd party apps, the first party apps can obviously use the password grant, whereas the 3rd party apps will use the Auth Code grant.\r\n\r\nOn top of this any request to any non-secure (as in public available even over https) endpoint, should validate that it has come from a valid app, now I'm toying with just having an appKey header or whether I should use 'client credentials' scope here?\r\n\r\nI suppose what I'm not sure on, is how to secure a private endpoint that require a user access token and stop someone just supplying the client access token to bypass this? Is there a way to validate the type of token to determine if it should be able to access a specific resource?"},"comment":{"url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/comments/227876045","html_url":"https://github.com/thephpleague/oauth2-server/issues/592#issuecomment-227876045","issue_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/592","id":227876045,"user":{"login":"TommyBs","id":952238,"avatar_url":"https://avatars.githubusercontent.com/u/952238?v=3","gravatar_id":"","url":"https://api.github.com/users/TommyBs","html_url":"https://github.com/TommyBs","followers_url":"https://api.github.com/users/TommyBs/followers","following_url":"https://api.github.com/users/TommyBs/following{/other_user}","gists_url":"https://api.github.com/users/TommyBs/gists{/gist_id}","starred_url":"https://api.github.com/users/TommyBs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TommyBs/subscriptions","organizations_url":"https://api.github.com/users/TommyBs/orgs","repos_url":"https://api.github.com/users/TommyBs/repos","events_url":"https://api.github.com/users/TommyBs/events{/privacy}","received_events_url":"https://api.github.com/users/TommyBs/received_events","type":"User","site_admin":false},"created_at":"2016-06-22T21:04:17Z","updated_at":"2016-06-22T21:04:17Z","body":"Hi sorry for the late follow up to this.\r\n\r\nI've been thinking about this, and there could be cases where either type is allowed to access the same endpoint. Similar to a facebook app where I could query a user endpoint with an app access token or a user access token and the response is different depending on which it is. In your response are you suggesting then that I should just check whether a oauth_user_identifier is part of the request to determine if it's a user or an app token?\r\n\r\nDo you think it would be a security risk to put the 'grant_type' as a parameter in the JWT? Then check this? Would this be tamper proof from outsiders bearing in mind they *shouldn't* be able to alter the JWT due to the signature? So something like this\r\n\r\n```\r\npublic function convertToJWT(CryptKey $privateKey)\r\n    {\r\n        return (new Builder())\r\n            ->setAudience($this->getClient()->getIdentifier())\r\n            ->setId($this->getIdentifier(), true)\r\n            ->setIssuedAt(time())\r\n            ->setNotBefore(time())\r\n            ->setExpiration($this->getExpiryDateTime()->getTimestamp())\r\n            ->setSubject($this->getUserIdentifier())\r\n            ->set('scopes', $this->getScopes())\r\n            ->set('grant_type', $this->getAccessTokenGrantType()) // Get grant type of token\r\n            ->sign(new Sha256(), new Key($privateKey->getKeyPath(), $privateKey->getPassPhrase()))\r\n            ->getToken();\r\n    }\r\n\r\n```\r\nThanks\r\n"}}
{"actor":{"display_login":"TommyBs"}}