title: OAuth 2: separating resource server and authorization server
body: <p>The OAuth 2 spec leads me to believe that the "resource server" and "authorization server" do not necessarily have to be the same application but I'm struggling to figure out how this is actually implemented in practice.</p>
  
  <p>As an example, suppose the following apps exist:</p>
  
  <ul>
  <li>resource server</li>
  <li>authorization server</li>
  <li>web frontend</li>
  <li>third-party client app</li>
  </ul>
  
  <p>Scenario #1: Logging in to web frontend</p>
  
  <ul>
  <li>user submits login form</li>
  <li>web app POSTs credentials to auth server (grant_type=password) and receives an access_token</li>
  <li>the web app stores the access_token in a session</li>
  <li>upon each subsequent request:
  
  <ul>
  <li>GET resource(s) from the resource server (w/ access_token in Authorization header) and render it in the web frontend</li>
  <li>if we get a 401 then log the user out (remove access_token from session)</li>
  </ul></li>
  </ul>
  
  <p>Scenario #2: Authorizing third-party app</p>
  
  <ul>
  <li>user requests authorization from auth service</li>
  <li>allow/deny form is displayed</li>
  <li>user is redirected back to client app with authorization code present</li>
  <li>client app POSTs code to auth service (grant_type=authorization_code) and receives an access_token</li>
  <li>client GETs resources from the resource server passing (w/ Auth header)</li>
  </ul>
  
  <p>The part I'm having trouble understanding is how to authenticate the user before showing the allow/deny form in scenario #2.  The user may be logged into the main web app but the auth service has no idea about that and would somehow need to authenticate the user again.  Does the auth service need to support login/sessions as well?</p>
  
  <p>I'm wondering if it might make more sense for the web app to be responsible for showing the allow/deny form for two reasons:</p>
  
  <ol>
  <li>it keeps all of the UI in a single app</li>
  <li>wouldn't force the user to resubmit his or her credentials if they are already logged in to the web app</li>
  </ol>
  
  <p>Here's one possible alternative to scenario #2:</p>
  
  <ul>
  <li>user requests authorization from web app</li>
  <li>allow/deny form is displayed</li>
  <li>web app POSTs to auth server creating a new grant, authorization code is returned</li>
  <li>web app redirects to client app with authorization code present</li>
  <li>client app POSTs code to auth service and receives access_token</li>
  </ul>
  
  <p>What's the best way to handle this?  Any general comments, advice, etc. would be awesome!</p>
  
  <p>Thanks</p>