If someone tries to access a secure part of your web app and they haven't logged in yet, the app redirects the user to the authorization server to identify themself. Mostly, this means users enter their credentials (username, email, password, and so on.)
The Authorization server one job to do, authenticate the user with their credentials and return claims back.
Claims are basically granted privileges lists. A user can have multiple claims to use portions of an app, such as viewing billing history, adding a bill, deleting a bill from history are different claims.
Once the authorization server validates the user with the provided credentials, it generates a token that is mapped to the user, and it ...
