Why can't OIDC authorization code flow be all back channel?

Question

I've been learning OIDC, especially authorization code flow.

The front channel just gets the authorization code, and then sends this to the client's back end code which then makes a back channel call to the identity provider with the authorization code, client and secret.

This is because you don't want the front end knowing the client secret as this is a security issue.

But, why can't the entire flow be back channel only?

Couldn't the front end make a call to its back end with all the necessary params such as scopes etc, then the backend uses the client ID and client secret, to make a call to the identity provider, and then the back end now has the access token and identity token?

Yearwood

Answer 1

OIDC (or OpenID Connect) is about authenticating users to a Relying Party (or Client) without divulging the user credentials to that Relying Party. The front channel flow is there to send the users browser off to a Provider that authenticates the user. If the flow was back channel only, the user would have had to provide his/her credentials to the Relying Party first, which defeats its purpose (e.g. LDAP would have been good enough for this).

Glen