Multiple consumers on an oauth2 client?

[jviersel-ipronto]

Maybe I misunderstand the Oauth2 standard or I am doing something wrong with Kong. I am using Kong + PostgresQL database.

Oauth2 clients are your applications, let's call mine 'MyApp'.
Consumers in kong are my users, let's call mine John and Andy, which will both be using MyApp.

So I created/updated a consumer for both John and Andy via the administrator API using PUT/consumers/john and /consumers/andy. Now I want to assign the client to them.

So I add MyApp via POST /consumers/john/oauth2, which works fine. But when I want to add it to the second user using POST /consumer/andy/oauth2, I get an error that the client_id must be unique and the requested one already exists.

Am I wrong using the same client_id for all users or did I miss some configuration option to make Kong accept the client_id on multiple users/consumers?

[dndx]

Hello @jviersel-ipronto,

If I am not mistaken, you should probably use different client_id for distinct consumers. Otherwise Kong would have no way to distinguish between them later. Each request in Kong can be associated with 0 or 1 consumer only.

[jviersel-ipronto]

I do understand this is the current implementation in Kong. But I am wondering if this is the way described in the Oath2 standards.

I do not see why Kong should distinguish between different Oauth2-clients. ACLs and other settings are assigned to routes, services or consumers, not to Oauth2-clients.

As far I did understand the OAuth2-standard, you register a Oauth2-client per application and multiple users (consumers in Kong) can use that application. This would mean you should be able to link multiple consumers to a Oauth2-client.

[jviersel-ipronto]

It's pretty quit here. I can't believe nobody else is facing the same problem.