Dynamic Client Registration OAuth2 on AWS - amazon-web-services

Question

I was hoping to see some examples on how to implement Dynamic client registration that generates client credentials for an OAuth2 flow on AWS.
Any references?

Answer 1

DCR generally works like this, but can vary quite a bit depending on the client scenario. Hopefully this gives you the general flavour of things:
STEP 1: GET A DCR ACCESS TOKEN TO USE FOR REGISTRATION
Typically this involves an initial OAuth flow with a dcr scope, to get a DCR access token, needed to register:
curl -X POST https://login.example.com/oauth/v2/token \
-H: "Content-Type: application/x-www-form-urlencoded" \
-H: "Authorization: some-credential" \
-d client_id=initial_client
-d scope=dcr
STEP 2: REGISTER AND GET A UNIQUE CLIENT
This involves a POST with a JSON request and response, simplified below:
curl -X POST https://login.example.com/oauth/v2/registration \
-H: "Authorization: dcr-access-token" \
-H: "Content-Type: application/json" \
-d grant_types=[client_credentials] \
-d scope='openid profile transactions'
The response then typically has quite a large payload, but in particular a unique client ID and secret are returned:
client_id: cj348034t534tu90
client_secret: h7890g723470fghfgh42rt
other-fields: ...
STEP 3: USE THE UNIQUE CLIENT
From that point onwards the client just uses the client ID and secret to get application level tokens:
curl -X POST https://login.example.com/oauth/v2/token \
-u "cj348034t534tu90:h7890g723470fghfgh42rt" \
-H: "Content-Type: application/x-www-form-urlencoded" \
-d scope='openid profile transactions'
DYNAMIC BUSINESS
DCR is quite a powerful concept and one scenario that showcases it is Open Banking, where approved merchants can automatically onboard and start calling bank APIs. In this case the initial DCR access token is retrieved based on Mutual TLS trust and other regulatory checks.
PROVIDERS
DCR features are provided by more advanced OAuth providers and I doubt it is supported by Amazon. Curity has plenty of resources on the design patterns though, so if you want more info, see these resources:
Curity Website - with a search for DCR
Introductory Video