Read a client registration as a set of rules

Setup

1. Set the shell variables: ISSUER, PRINTER_ID and PRINTER_SECRET for lab-printer, ORDERS_ID and ORDERS_SECRET for lab-print-orders, APP_ID for lab-printer-app, API_ID and API_SECRET for lab-photo-api, and enc.

2. Get a current printer access token for Ava with the code flow from the authorization code labs, and keep it as TOKEN.

3. Press Start on this page.

Walkthrough

1. Open OAuth > Clients > lab-printer > View and write its registration in the lesson's format. Read the authentication method from discovery's token_endpoint_auth_methods_supported.

Client ID: <generated by the tenant, not chosen>
Client type: confidential
Redirect URIs: http://127.0.0.1:8765/callback, https://beyondthelogin.dev/lab/callback/
Grant types: authorization_code, refresh_token
Scopes it may request: every common scope (Restrict scopes is off)
Client authentication: client_secret_basic

Do the same for lab-print-orders: confidential, no redirect URIs, client_credentials, only prints.create (Restrict scopes is on), client_secret_basic.

Why it matters: each line is a rule the authorization server applies to every later request, not paperwork.

2. Turn lines into requests that fall outside them.

   • Grant type: client credentials as the printer answers unauthorized_client, as in the Choosing a flow lab.

   • Redirect URI: an authorization request for the printer with https://beyondthelogin.dev/lab/callback (no trailing slash) stops on the tenant's error page.

   • Scopes: curl -s -u "$ORDERS_ID:$ORDERS_SECRET" -d grant_type=client_credentials -d scope=photos.read "$ISSUER/oauth/token" | jq answers invalid_scope. This server rejects the request rather than silently dropping the scope.

Why it matters: a request outside the registration never reaches consent, policy or the API.

3. Suspend one client. Open OAuth > Clients > lab-printer > Edit, untick Enabled and save. The editor warns that saving revokes the client's tokens, codes and remembered consent.

   • An authorization request for the printer stops on the tenant's error page.

   • Client authentication as the printer, for example curl -s -i -u "$PRINTER_ID:$PRINTER_SECRET" -d grant_type=refresh_token -d refresh_token=x "$ISSUER/oauth/token", answers 401 invalid_client, "Client authentication failed. Check the client ID and secret, and that the client is enabled."

   • btl-lab introspect "$TOKEN" answers {"active": false} for the token issued before the change.

4. The sibling keeps working. Run the public app's loopback flow from the Public and confidential clients lab with lab-printer-app, as Ava. It succeeds.

Why it matters: one registration per deployment lets the photo service suspend exactly the client that misbehaves, without breaking its siblings.

5. Re-enable the printer: tick Enabled and save. TOKEN stays inactive. Turning a client on restores nothing it lost.

Restore: confirm lab-printer shows Enabled.

6. Optional, with Lab Mail: use PRINTER_ID in an authorization request to $ISSUER2. It stops on that tenant's error page as an unknown client. The ID means something only to the issuer that created it.

7. Registration through an API is not offered here yet.

POST $ISSUER/oauth/register HTTP/1.1
Content-Type: application/json

{}

The answer is 501. Clients in this tenant are created by an administrator; dynamic registration is gap G9.

Break it

Step 3 is the deliberate suspension, and step 5 restores it.

Check your work

Press Check my progress. Logs also has oauth.authorize rejected invalid_client for the suspended client's authorization request, and oauth.register rejected not_implemented with status 501.

Cleanup

1. Confirm lab-printer is Enabled.

There is no list yet of the people who connected a client (G40). Changing a client's settings clears its remembered consent instead.