title: Login App with IdentityServer4
body: <p>I have to develop a SSO system and I have to do it using IdentityServer4. I have gone through the documentation and examples but I have some doubts. To be honest I don't quite get it, but I am really new in Oauth2 and OpenId Connect. </p>
  
  <p>We will have a bunch of clients (web apps), each of one of those will have their own Web  APi. And we have to have a centraliced Login App for all of those.  I think the example with the javascript client is the closes to the thing we want to achieve. Also, a user might have permission to access one client (app), but not another, so the IdentityServer must provide information about wich clients (apps), that particularly user can access.</p>
  
  <p>So, These are the things I don Understand:</p>
  
  <p>1.- In the documentation I can read there are two tokens, an Identity Token and Access token. But in the examples all I see are the access tokens. It seems to me that the access token is the one with all de info needed. am I wrong?</p>
  
  <p>2.- Also, I have read about de Grant Types and I'am not quite sure wich one we must use. At first I thought to use the ResourceOwner password, because it requires the client, the secret, a user and a password, wich I assumed it could be the end user. I found this example <a href="http://sunilrav.com/post/How-to-Customize-Authentication-in-Identity-Server-4" rel="nofollow noreferrer">http://sunilrav.com/post/How-to-Customize-Authentication-in-Identity-Server-4</a> were one could customise the class that validate the user and password. I thought that this could be the way to go but the documentation statesa about this grant type  "<strong><em>...This is so called “non-interactive” authentication and is generally not recommended.</em></strong>". The javascript client example uses the implicit Grat type, wich the documentation states <strong><em>is for browser-based applications</em></strong> (our client apps will all be browser based using react).</p>
  
  <p>3.- can my Login app be a Javascript (react) app? The example Quickstart is made in MVC.NET. This login app connects directly to de IS4 server without asking for a access token? (In the example the app is embebed in the IS4).</p>
  
  <p>4.- Can I protect with IS4 a WEB API which is developed in .net framework (4.6.2) and not in .Net Core? I havent Found Any examples.</p>
  
  <p>the documentatios I followed is the offcial. The examples (quickstart) are also there. (I can't post more than two links).</p>
  
  <p>thank you very much for reading and for your help.</p>