{"action":"created","issue":{"url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/630","labels_url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/630/labels{/name}","comments_url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/630/comments","events_url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/630/events","html_url":"https://github.com/bshaffer/oauth2-server-php/issues/630","id":101244504,"number":630,"title":"Authenticating my Web application users using username/password and then JWT","user":{"login":"danr1979","id":4936852,"avatar_url":"https://avatars.githubusercontent.com/u/4936852?v=3","gravatar_id":"","url":"https://api.github.com/users/danr1979","html_url":"https://github.com/danr1979","followers_url":"https://api.github.com/users/danr1979/followers","following_url":"https://api.github.com/users/danr1979/following{/other_user}","gists_url":"https://api.github.com/users/danr1979/gists{/gist_id}","starred_url":"https://api.github.com/users/danr1979/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danr1979/subscriptions","organizations_url":"https://api.github.com/users/danr1979/orgs","repos_url":"https://api.github.com/users/danr1979/repos","events_url":"https://api.github.com/users/danr1979/events{/privacy}","received_events_url":"https://api.github.com/users/danr1979/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-08-16T09:06:18Z","updated_at":"2015-08-16T13:48:19Z","closed_at":null,"body":"Hi.\r\n\r\nI have a Web application written in EmberJS that calls an API for its data requirements.  I'm looking to authenticate my Web application users by having them submit a username and password and be given a JWT in return.  Then, each time they try to access a page within the application the JWT will be sent in the request to the API in order to determine if they have permission to access the resource they are requesting.\r\n\r\nI've read through the documentation for the oauth2-server-php library but I'm still a little confused as to how to implement my authorisation mechanism.  It looks like I'd want to use the \"User Credentials\" grant type to get the initial token when they submit their username and password but then for subsequent requests I'd need the \"JWT Bearer\" grant to check that their JWT is valid.  Is this correct?  Also, it seems that the \"User Credentials\" grant returns a standard token rather than a JWT so how would I go about changing this so that a JWT is returned instead?\r\n\r\nAny help you can offer would be gratefully received.\r\n\r\nThanks."},"comment":{"url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/comments/131553573","html_url":"https://github.com/bshaffer/oauth2-server-php/issues/630#issuecomment-131553573","issue_url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/630","id":131553573,"user":{"login":"danr1979","id":4936852,"avatar_url":"https://avatars.githubusercontent.com/u/4936852?v=3","gravatar_id":"","url":"https://api.github.com/users/danr1979","html_url":"https://github.com/danr1979","followers_url":"https://api.github.com/users/danr1979/followers","following_url":"https://api.github.com/users/danr1979/following{/other_user}","gists_url":"https://api.github.com/users/danr1979/gists{/gist_id}","starred_url":"https://api.github.com/users/danr1979/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danr1979/subscriptions","organizations_url":"https://api.github.com/users/danr1979/orgs","repos_url":"https://api.github.com/users/danr1979/repos","events_url":"https://api.github.com/users/danr1979/events{/privacy}","received_events_url":"https://api.github.com/users/danr1979/received_events","type":"User","site_admin":false},"created_at":"2015-08-16T13:48:19Z","updated_at":"2015-08-16T13:48:19Z","body":"Thanks for your swift response! \r\n\r\nSo, I handle the username/password authentication manually using my own code & use either this library or another to generate the jwt. Then, once the jwt has been returned to the requestor they can submit that in subsequent requests & this library can verify them using the jwt bearer grant?\r\n\r\nIs that right?\r\n\r\nThanks."}}