Farasath blogs

Quoting from  https://aaronparecki.com/oauth-2-simplified/ Single-page apps (or browser-based apps) run entirely in the browser after loading the source code from a web page. Since the entire source code is available to the browser, they cannot maintain the confidentiality of their client secret, so the secret is not used in this case. The flow is exactly the same as the authorization code flow above, but at the last step, the authorization code is exchanged for an access token without using the client secret .  Note: Previously, it was recommended that browser-based apps use the "Implicit" flow, which returns an access token immediately and does not have a token exchange step. In the time since the spec was originally written, the industry best practice has changed to recommend that the authorization code flow be used without the client secret. This provides more opportunities to create a secure flow, such as using the state parameter. References:  Redhat ,...

Configuring SAML SSO for an external Service Provider with WSO2 Identity Server is probably one of the most common use cases I heard from my day 1 at WSO2. Setting up is quite easy, Just follow the docs here . Now let me start from there, what if someone wants to retrieve certain claims of a user in the SAML Response. How easy is it to configure that? Well, Let me show you :) Step 1 Assuming that you have setup a Service Provider in Identity Server by following the docs, you should have a configuration like the one below, The most important part of this config is the " Enable Attribute Profile " tick, that allows you to get a set of pre-configured claims in the SAML response. Be sure to have it ticked. Step 2 Now your are done with Step 1, In Step 2 you simply configure the claims that you want to be returned in the SAML response. To do this, Go to the " Claim Configuration " section of the service provider, Now click on " Add Claim ...