title: IdentityServer - separate authentification, authorization, resources without any use of UI-websites?
body: <p>I want to have an architecture made up of these devices / programs with different roles (which are all separated, none of these roles must exist in one and the same instance):</p>
  
  <ul>
  <li>CLIENT </li>
  <li>AUTHENTICATION-SERVER</li>
  <li>AUTHORIZATION-SERVER (there can be a multitude of these)</li>
  <li>RESOURCE-SERVER (also many possible)</li>
  </ul>
  
  <p>And:</p>
  
  <p>I don't want to use any websites a user has to navigate to.</p>
  
  <p>From my studies of OAuth and Open ID Connect I would assume that a Client could get an ID_TOKEN (after authorization) from an AUTHENTICATION-SERVER and could then request ACCESS_TOKENS to different resources from the AUTHORIZATION-SERVERs.</p>
  
  <p>I guess the method I described allows identity theft on the client side.</p>
  
  <p>I cant find a way to easily get id tokens from an authorization server to a client (which I could then use to authenticate to multiple authorization servers). My clients are trusted. I want to use native apps and implement open id connect among them anyway.</p>
  
  <p>I do not want to use any websites as of now and still need to be able to have a secure communication with associations of claims to users and everything. Are OpenID Connect and its possible 'Flows' appropiate for this? Are there any other implementations that would allow the flow I described (or mabye derivations of OpenID Connect)?</p>