Hi @avenhard
Joke: how do you properly implement Resource Owner Password Grant? Don’t! Use Auth Code instead.
Sorry, not funny to anyone but me I bet.
ROPG is an anti-pattern, it is not recommended.
I would suggest either Auth Code or Auth Code + PKCE, depending on if you do the token exchange in the Angular front end or the .Net backend (use PKCE for the front end exchange).
Use Auth0’s CNAME feature so that even though you are redirecting to Auth0, the domain name belongs to you.
I hope this helps.
John