allow for automatic approval of authorization

[corbosman]

We use OAuth2 for internal web apps and user management and have no need for an authorization approval view. In lucadegasperi's oauth server you could just bypass it. I cant find any (easy) way to bypass it in Passport.

Would be nice to allow you to bypass this view.

[craigpaul]

@corbosman You could just use the Password Grant or the Fresh Api Token Middleware method instead since this is all internal use.

[corbosman]

@craigpaul It's multiple apps in multiple languages, using a central laravel server as single signon and identity provider. So I dont see how the fresh api token middleware is going to work. I also dont think that the password grant is going to work because of the single signon part. If I go to app 1, login in through oauth, then go to app 2, it should initiate the oauth cycle and immediately login the user into the second app without even providing a password. This worked fine with the now deprecated server from lucadegasperi's.

edit: actually, you may be right. I'll look into using the password grant.

[craigpaul]

@corbosman Ah ic what you mean about the middleware, that definitely isn't the right way. I assumed your apps were all in Laravel, so that's out the window.

If the password grant doesn't work out for you let me know and we can talk out how to get something working.

[corbosman]

@craigpaul I actually dont think the password grant is going to work. It would mean rewriting all our oauth client apps to add a login/pass screen and do a password grant instead of an authcode grant. That in itself is enough for me to try and find an alternative route to remove the approval view.

[craigpaul]

@corbosman Ah so you're pretty far into this. Well then, I would suggest you manually remap the route to your own controller and adjust the logic as needed.

web.php

Route::get('/oauth/authorize', [
    'uses' => 'AuthorizationController@authorize',
]);

That way you can take the logic from the existing controller and remove the view response that is returned in favour of what you need.

[corbosman]

Heh, was just doing that. Thanks for the help, hopefully in a future release there'll be a way to skip the approval view.

[corbosman]

Ok, that wasnt that difficult. For others that might want this functionality. Copied the AuthorizationController and some code from ApproveAuthorizationController and put them in my own Controller. Only gotcha is the route order, you cant add this route through web.php as the Passport::routes() is run after and overrides those routes. So I just added the route in the AuthServiceProvider.

Still, a way to just bypass the approval view would be appreciated.

[damwhit]

@corbosman looking to do the exact same thing, for the same reasons. Would you mind sending me your own controller code as well as the route added in AuthServiceProvider?

Any additional help is much appreciated. Also, agreed - this would be an excellent thing to have out of the box with passport.

[corbosman]

I use this. Had to replace the whole controller instead of extending the original controller because of the private methods.

https://laravel.io/bin/6LN6q

[damwhit]

This is great. Thanks @corbosman!

[ReckeDJ]

I have the same situation as I want to mark some of my clients as 'trusted' or 'first-party'. In this case, the approval screen should be skipped, otherwise the user can approve or deny the access in the approval view. I'm thinking of a simple boolean 'trusted' attached to a client in the database, as soon as the boolean is true it would redirect the user immediately with approved access.
How do you think about this guys?

[qrazi]

A fyi, this now seems to be included in the 2.0 branch, specifically in version 2.0.4. See this commit: 88e9597

Edit:
The fix above however determines grant was approved before based on existence of a valid access token. lucadegasperi/oauth2-server-laravel kept track of previous approvements by users through a separate grants table. That would be a better check here I think. It would also reflect better in de default AuthorizedClients-VueJS component to show which applications have a grant, instead of all (or complimentary to) valid access tokens, as it does now.

[corbosman]

I dont think so. This just makes sure you dont get the auth screen when you have a valid token. I would want to be able to never see the auth screen.

[qrazi]

@corbosman You are right, whilst implementing my use case I lost track of your exact use case, which the commit I referenced indeed does not support...

[themsaid]

Closing for lack of activity, hope you got the help you needed :)