title: WebAPI Mixing Implicit Flow and Client Credentials Flow
body: <p>I have a WebAPI solution that secures it's controller methods via the [Authorize] attribute. It verifies that a given user has the appropriate roles, which are basically claims that come from an IdentityServer3.</p>
  
  <p>There are several single page application clients that interact with this WebAPI, and the client users are authenticated/authorized using implicit flow.</p>
  
  <p>So far pretty standard and simple, it all works fine...</p>
  
  <p>Now I have a need for background process to make calls to this same WebAPI. This effectively becomes machine to machine communication. Based on all the documentation I have read this is a situation for Client Credentials flow. No users are involved. </p>
  
  <p><strong>The problem...</strong></p>
  
  <p>Given that no user is involved, this also means no subject, no claims and obviously no roles. If I am not mistaken a client does not have claims. Since my controller methods are secured by roles, how then can a client such as this be authorized to use the service/resource?</p>
  
  <p>I read that a client should have only one flow, but what about a resource? The flow used by client shouldn't be important to the resource, except that the access token will have no claims depending on the client flow. So in that context the flow is also relevant to a resource when it is secured by claims. Am I confused?</p>
  
  <p>Should I create a new service specifically for client credentials flow? Rig the identity server to support claims on clients? </p>
  
  <p>I am looking for best practices here.</p>
  
  <p><strong>Edit</strong></p>
  
  <p>Please also refer to this Github discussion...
  <a href="https://github.com/IdentityServer/IdentityServer3/issues/76" rel="nofollow">Issue 76</a></p>
  
  <blockquote>
    <p>If the subject is null - there is no human involved.</p>
    
    <p>We are not planning to have claims for clients. The client identity
    and scopes should be enough.</p>
    
    <h2>leastprivilege</h2>
  </blockquote>
  
  <p>Also refer to...
  <a href="https://github.com/IdentityServer/IdentityServer3/issues/79#issue-33235316" rel="nofollow">Issue 79</a></p>
  
  <blockquote>
    <p>Well - in general a client should only have one flow since it can
    result in security problems if the wrong combination of flows is
    configured (e.g. code and implicit).</p>
    
    <h2>leastprivilege</h2>
  </blockquote>