Because the Resource Owner Password (ROP) Flow involves the application handling the user’s password, it must not be used by third-party clients.
Though we do not recommend it, highly-trusted applications can use the Password Flow (defined in OAuth 2.0 RFC 6749, section 4.3 and sometimes called Resource Owner Password Grant or ROPG), which requests that users provide credentials (username/email/phone and password), typically using an interactive form. Because credentials are sent to the backend and can be stored for future use before being exchanged for an , it is imperative that the application is absolutely trusted with this information.Even if this condition is met, the Resource Owner Password Flow should only be used when redirect-based flows (like the Authorization Code Flow) cannot be used.
Auth0 provides an extension grant that offers similar functionality to the Resource Owner Password grant, but allows you to keep separate user directories (which map to separate connections) and specify which one to use during the flow.For example, let’s say you want to present a dropdown on your application’s login user interface that allows users to choose their user type: Employees or Customers. In this case, you would configure Employees and Customers as realms (and set up a corresponding connection for each), which allows employee and customer credentials to be kept in separate user directories. When you request a token, you will submit the realm value along with the user’s credentials and the submitted realm will be used to verify the password.To learn more about implementing this extension grant, read Call Your API Using Resource Owner Password Flow: Configure Realm Support.
Rules will run for the Resource Owner Password Flow (including the Realm extension grant). However, redirect rules won’t work. If you try to perform a redirect by specifying context.redirect in your rule, the authentication flow will return an error. To learn more about rules, read Auth0 Rules. To learn more about redirect rules, read Redirect Users from Within Rules.
