Skip to content

Commit 7e2b97f

Browse files
Add Resource Owner Password Grant flow support
1 parent fe57431 commit 7e2b97f

File tree

6 files changed

+1367
-0
lines changed

6 files changed

+1367
-0
lines changed

README.md

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,56 @@ async def callback(request: Request):
104104
return RedirectResponse(url="/")
105105
```
106106

107+
### 4. Resource Owner Password Grant (Direct Authentication)
108+
109+
> [!WARNING]
110+
> The Resource Owner Password Grant flow should **ONLY** be used by highly-trusted first-party applications where redirect-based flows cannot be used. This flow requires users to expose their credentials directly to the application.
111+
>
112+
> **Always prefer the Authorization Code Flow with PKCE** (interactive login above) for better security when possible.
113+
114+
For scenarios where redirect-based flows are not feasible, you can authenticate users directly with their username and password:
115+
116+
```python
117+
from auth0_server_python.auth_types import TokenByPasswordOptions
118+
119+
# Basic password authentication
120+
result = await auth0.get_token_by_password(
121+
TokenByPasswordOptions(
122+
username="user@example.com",
123+
password="secure_password"
124+
)
125+
)
126+
127+
# Access the authenticated user
128+
user = result["state_data"]["user"]
129+
print(f"Logged in as: {user['email']}")
130+
```
131+
132+
#### Server-Side IP Forwarding
133+
134+
When calling this endpoint from a server, you can forward the end-user's IP address for security and auditing purposes:
135+
136+
```python
137+
# In a server-side application (e.g., FastAPI backend)
138+
@app.post("/api/auth/login")
139+
async def login(request: Request, credentials: LoginCredentials):
140+
# Get the end-user's IP address
141+
client_ip = request.client.host
142+
143+
result = await auth0.get_token_by_password(
144+
TokenByPasswordOptions(
145+
username=credentials.username,
146+
password=credentials.password,
147+
auth0_forwarded_for=client_ip # Forward the end-user's IP
148+
)
149+
)
150+
return result
151+
```
152+
153+
For more examples including realm specification and audience/scope usage, see [examples/ResourceOwnerPasswordGrant.md](examples/ResourceOwnerPasswordGrant.md).
154+
155+
**Learn more:** [Resource Owner Password Flow Documentation](https://auth0.com/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow)
156+
107157
## Feedback
108158

109159
### Contributing

0 commit comments

Comments
 (0)