# Flows

The [OAuth 2.0 Authorization Framework](https://tools.ietf.org/html/rfc6749) specifies a protocol, or flows, for interaction between resource owners
(users), clients (applications), authorization servers and [resource servers](https://docs.stoe.no/bankid-oidc-provider/core-concepts/resource-server.md).

This protocol is based on the use of [Access tokens](https://docs.stoe.no/bankid-oidc-provider/core-concepts/access-tokens.md), as a way for the client to request an end user's protected
resources with the end user's approval, without compromising or exposing the end user's credentials.

```
     +--------+                               +---------------+
     |        |--(A)- Authorization Request ->|   Resource    |
     |        |                               |     Owner     |
     |        |<-(B)-- Authorization Grant ---|               |
     |        |                               +---------------+
     |        |
     |        |                               +---------------+
     |        |--(C)-- Authorization Grant -->| Authorization |
     | Client |                               |     Server    |
     |        |<-(D)----- Access Token -------|               |
     |        |                               +---------------+
     |        |
     |        |                               +---------------+
     |        |--(E)----- Access Token ------>|    Resource   |
     |        |                               |     Server    |
     |        |<-(F)--- Protected Resource ---|               |
     +--------+                               +---------------+
```

Accordingly, an [authorization grant](https://tools.ietf.org/html/rfc6749#section-1.3) is a method for which
the client can obtain the [Access token](https://docs.stoe.no/bankid-oidc-provider/core-concepts/access-tokens.md) needed to get the
end user's data.

BankID supports two grant types:

- [Authorization Code Flow](https://tools.ietf.org/html/rfc6749#section-1.3.1)
- [Client Credentials Flow](https://tools.ietf.org/html/rfc6749#section-1.3.4)

These flows are used independently or combined in our different products. PAdES and SEID-SDO signing,
for example, start out with a client credential flow (where the Access token is used to create and upload the sign order),
followed by an authorization code flow (where the Access token is used to download the completed sign order from
the [resource server](https://docs.stoe.no/bankid-oidc-provider/core-concepts/resource-server.md)).

## Authorization Code Flow

The authorization code flow concerns the authentication of end users, followed by an [ID Token](https://docs.stoe.no/bankid-oidc-provider/core-concepts/id-token.md)
with the end-user data and an [Access Token](https://docs.stoe.no/bankid-oidc-provider/core-concepts/access-tokens.md) that may access to other BankID resource servers. In short;

1. The end user authenticates, and is returned to the client via the redirectURL
2. The client receives an authorization code from BankID (B), and uses this in exchange for tokens via the Token endpoint (C/D)
   1. The [ID Token](https://docs.stoe.no/bankid-oidc-provider/core-concepts/id-token.md) identifies the user
   2. The [Access Token](https://docs.stoe.no/bankid-oidc-provider/core-concepts/access-tokens.md) can be used to access other [resource servers](https://docs.stoe.no/bankid-oidc-provider/core-concepts/resource-server.md) (E/F)
   3. The [Refresh token](https://docs.stoe.no/bankid-oidc-provider/core-concepts/refresh-tokens.md) can be used to issue new Access tokens

## Client Credential Flow

The client credential flow concerns authorization of access to BankID [resource servers](https://docs.stoe.no/bankid-oidc-provider/core-concepts/refresh-tokens.md) directly from an OIDC Client, without involving an end-user. In short;

1. The client requests an [Access token](https://docs.stoe.no/bankid-oidc-provider/core-concepts/access-tokens.md) from BankID (C)
2. If the client credentials are valid (see [client authentication](https://docs.stoe.no/bankid-oidc-provider/core-concepts/client-authentication.md)), the client receives an Access token (D), which can be used to request other resources (E/F)