[Feature] User Specific OAuth

[Nikhil-Nandagopal]

Summary

There are times when OAuth applications need to be used by a group of users and need to authenticate separately for each individual user. Today OAuth only supports authenticating for a single user and uses that user's credentials for every request.

[japrogramer]

Hello, I am trying to get OAuth 2 working as an Authentication system on a per app per user bases like it is done
with JWT in this tutorial, https://docs.appsmith.com/how-to-guides/how-to-implement-custom-authentication-on-appsmith

storing the JWT token in the appsmith.store seems simple enough,

Also Noticed that there is an OAuth 2 implementation but it is on a per datasources

https://docs.appsmith.com/core-concepts/connecting-to-data-sources/authentication/oauth2-authentication

It seems logical to store the Access Token in the appsmith.store like it is done in the JWT example,

I have two questions,

1. are API requests in an app done server side on appsmith, API requests like the one made here JWT?

2. can I Include extra code to run server side on an API request ?

[Nikhil-Nandagopal]

@japrogramer yes API requests are done server-side with values passed to the server from the client. Extra code cannot be run server-side today. What code are you looking to run server-side?

[japrogramer]

I know that the OAuth Access Token is added to the API Requests and the application Im trying to authenticate with is not a Datastore, its a website. So I wanted the gain access to that token to store in the appsmith store to use like a jwt token. I know you emailed me linking me to the OAuth docs.

[japrogramer]

@Nikhil-Nandagopal

I can see that the Data source already has an Authenticated API that supports OAUTh

Problem is, that the authentication happens when I save the datasource and not on a per visitor basis,
I think this behavior is incorrect for many apps.

This could be remedied if I could move this button to authorize the datasource into the app and have the ACCESS-TOKEN header set
on the client side and used on every request to the datastore on each visitor so that each visitor needs to
authenticate with the datastore first before using the APIs that are assigned to that store.

And it would be even better if I could then wrap the OAuth authentication around a database so that I don't have to pass the credentials for the database to the app. Instead let me worry about checking the token.

Currently when I try to use the app it tells me the API isn't authenticated and I think that the correct behavior should be to try to authenticate as the app is being used with the visitors credentials

[Nikhil-Nandagopal]

@japrogramer thanks! Yes user-specific authentication does make sense and is on our roadmap