In all of the previous videos, we looked at the scenario where one AIPA is trying to invoke other aipa
staying inside a secure resource or what?
And we saw how to leverage key up to were you not to implement application and authorization using or
to framework.
Now, in this lecture, let's try to understand another scenario where a Web application, which might
be based upon Angular app React app, is trying to invoke an app present inside a secure resource somewhere
so that that data boster by the resource our can be displayed on the UI.
So this is the another scenario that we can focus now and try to understand how it works in this scenario.
So the main difference between Web application invocation and Bowsman API invocation is inside Web application.
We will have an user who enter the credentials, and this user is the resource Warner, who wants the
resources present inside every source.
So my Web application will act as a client application like we saw in that WATO framework.
And definitely the Granter type that will be hard to follow for this scenario, a authorization code
grant flow.
So let's try to go and revise what is operation code granting flow inside or to framework like you can
see here.
First, as an user, I can use a client application so I can tell to my client application.
I want to display the my launce detailed SARS-CoV-2 students which are hosted on the resource.
So what then?
My client application will redirect to me to Operation Server login page, where I can enter my username
and password along with the client I.D..
So if my authentication is successful, I will get the authorization code in the written now using the
authorization code.
My client will again have to make a call to what server by passing client ID and client secret.
So if my claim secret is valid, I will get a successful access token from the operation server.
Once I get a successful access token from the orzo work, then communication between resource server
and whatsoever and client is pretty similar to like what we discussed before.
And like, you know, here my client under authorization so will interact two times the very first time
the user will enter his credentials.
Along with the user credentials, we should also Poza what is a claim daily.
So once I get the authorization call now using authorization code, I again how to invoke the authorization
Sarwari AIPA in order to get an access token this time along with the authorization call, I need to
pass clean, tidy and clean secret as well.
So these two different EPA calls will bring more security into authorization code grant type compared
to implicit grant type.
In implicit grandpap, everything will be in a single call.
There is no need of operation code, but that is very less secure and prone to security issues.
So due to that reason, whenever you have a Web application into picture, please make sure you are
using operation code grant type.
And this is the most commonly used understander grant that we have inside or framework.
So now we have a clarity that we are going to use or to call a grant type inside our easy bank application.
So here we need to make sure we are creating a new client ID inside key clocktower.
And definitely we should also create an user details so that he has access to the resource so that we
are maintaining in the backend.
So let's try to create an lengthily and the user details inside key cluck's over in that next lecture.
Thank you.
And I'll see you in that next lecture.
Bye.