Senior LevelAuthentication & Authorization
How do you implement a Custom OAuth 2.0 Grant Type in an enterprise Authorization Server?
❓ Interview Prompt: Explain RFC 6749 extension grant rules, URI grant type identifiers, custom validation logic, and token issuance.
While OAuth 2.0 defines standard grant types ('authorization_code', 'client_credentials', 'refresh_token'), enterprise platforms often require Custom OAuth 2.0 Grant Types (e.g. authenticating via legacy hardware tokens, mobile SAML assertions, or custom biometric payloads).
Specification Rules (RFC 6749 Section 4.5):
1
URI Grant Type Identifier: Custom grant types MUST be identified by absolute URIs (e.g. 'grant_type=urn:company:params:oauth:grant-type:biometric_assertion').
2
Custom Parameters: Accept domain-specific parameters ('biometric_payload', 'device_signature').
3
Validation Handler: The Auth Server verifies custom parameters and returns standard OAuth 2.0 token response JSON ('access_token', 'expires_in', 'token_type').
Code Implementation Example
typescript
// Registering Custom Grant Type Handler in Authorization Server
async function handleCustomBiometricGrant(reqBody: any): Promise<OAuthTokenResponse> {
const { grant_type, biometric_payload, client_id } = reqBody;
if (grant_type !== 'urn:company:params:oauth:grant-type:biometric_assertion') {
throw new Error('invalid_grant');
}
// 1. Verify custom biometric payload
const user = await verifyBiometricSignature(biometric_payload);
if (!user) throw new Error('invalid_grant');
// 2. Issue standard OAuth token pair
const accessToken = generateAccessToken(user, client_id);
const refreshToken = generateRefreshToken(user, client_id);
return { access_token: accessToken, token_type: 'Bearer', expires_in: 900, refresh_token: refreshToken };
}💡Implementing custom OAuth 2.0 Grant Type handler for biometric assertion payloads.
🎯 Interview Key Takeaway
Custom OAuth 2.0 grant types use absolute URI identifiers to process non-standard enterprise credentials into OAuth token pairs.
#Custom Grant#OAuth 2.0#RFC 6749#Extensibility#Senior
Back to all Authentication & Authorization Questions→