docs: re-add tutorial on consent app by @matteosuppo

docs/SUMMARY.md

@@ -29,6 +29,8 @@
     - [HMAC-SHA256](security.md#hmac-sha256)
     - [BCrypt](security.md#bcrypt)
   - [Access Control](security.md##how-does-access-control-work-with-hydra)
+* How-Tos
+  * [Secure the consent app](how-to/consent-app.md)
 * [Client Libraries](sdk.md)
   * [Hydra SDK for Go](sdk/go.md)
 * [Contribute](contribute.md)

docs/how-to/consent-app.md

@@ -0,0 +1,65 @@
+# Secure the consent app
+
+This tutorial requires to have read and understood [OAuth 2.0 & OpenID Connect](../oauth2.md).
+
+A consent app should never use the root hydra credentials, and fortunately you can create in two simple steps:
+
+## 1. Create the client in Hydra
+
+A consent app needs to communicate with hydra, so it needs a client:
+
+```json
+{
+    "id": "YOURCONSENTID",
+    "client_secret": "YOURCONSENTSECRET",
+    "client_name": "consent",
+    "redirect_uris": [],
+    "grant_types": [
+        "client_credentials"
+    ],
+    "response_types": [
+        "token"
+    ],
+    "scope": "hydra.keys.get"
+}
+```
+
+`hydra.keys.get` is the only scope that's strictly required for the consent flow, but you may need to
+use other scopes.
+
+To create the client you can save the json configuration on a file ```consent.json``` and then issue the command
+
+```
+$ hydra clients import consent.json
+```
+
+## 2. Grant permissions to the client
+
+Giving the `hydra.keys.get` scope is not enough. Hydra's warden needs an explicit policy to access hydra's keys.
+
+```json
+{
+    "actions": [
+        "get"
+    ] ,
+    "conditions": {},
+    "description": "Allow consent app to access hydra's keys" ,
+    "effect": "allow" ,
+    "id": "consent_keys" ,
+    "resources": [
+        "rn:hydra:hydra.consent.challenge:public"
+        "rn:hydra:hydra.consent.response:private"
+    ] ,
+    "subjects": [
+        "YOURCONSENTID"
+    ]
+}
+```
+
+We are granting access explicitedly only to the two strictly necessary keys for the consent flow
+
+To create the policy you can save the json configuration on a file ```policy.json``` and then issue the command
+
+```
+$ hydra policies create -f policy.json
+```

docs/tutorial.md

@@ -1,4 +1,4 @@
-### 5 Minute Tutorial
+# 5 Minute Tutorial
 
 In this example, you will set up Hydra, a Postgres instance and an exemplary identity provider written in React using docker compose. It will take you about 5 minutes to get complete this tutorial.