What options do we have with Hydra to avoid consent UI being shown to users with certain apps/clients?
It does not support resource owner grant.
What are the best practices to resolve this and how does hydra address this issue?
You control the UI. Just don’t show it.
1 Like
Q.1 - You mean, we can just call the hydra admin endpoint with granted scopes values same as whatever scope were requested by the client when consent endpoint (URLS_CONSENT endpoint) is called?
Q.2 - During this endpoint invocation (configured as URLS_CONSENT), can we determine what scopes were earlier authorized by that logged user for that client (if those were authorized before)
You can find info about this in the Hydra docs
In certain scenarios (e.g. a special OAuth2 Client) you might not want to show the consent screen at all. In those cases you can choose to skip showing the UI and just accept the consent. Please keep in mind that OAuth2 is a delegation protocol and that it makes most sense for third-party access. Not showing the consent screen will break OpenID Connect Certification.
1 Like
Thank you for sharing the details. I was little confused about consent App. I downloaded the example nodejs app and that explained all my questions on how that flow is working.
Appreciate!