Given that MRA's Media Catalogue API is public and accessible, not just to registered partners but also to communities of developers in general, MRA wanted an authorization mechanism that is flexible yet robust. Although OAuth 2.0 was broadly accepted as the way forward in terms of authorizing users, the question remained as to what OAuth 2.0 is to implement. After careful consideration, MRA made the following conclusions:
- The API gateway should act as resource server and thus enforce policies such as only users with valid tokens and corresponding authorization grants could access an API.
- The API gateway as resource owner should be agnostic of what OAuth 2.0 flow is implemented by a given application.
- The OAuth 2.0 Authorization Server should be flexible enough to support in the long term multiple authorization flows. However, MRA felt that the Implicit grant...