OAuth

• It is an Open protocol for Authorization
• Example:
  • You login to facebook, another website wants to use your facebook information and sign you in but you don’t want to provide your credentials again.

OAuth 2.0

• It is RFC 6749
• It is a framework
• It is a loose agreement, not a contract
• It leaves many things undefined
• Various OAuth2 implementations are not compatible with vendor types

Terminologies

ref: https://auth0.com/docs/get-started/authentication-and-authorization-flow/which-oauth-2-0-flow-should-i-use

Resource Owner

Entity that can grant access to a protected resource. Typically, this is the end-user (which is human).

Client

Application requesting access to a protected resource on behalf of the Resource Owner.

Types of Clients:

• Confidential Client:
• Public Client: ??????

Resource Server

Server hosting the protected resources. This is the API you want to access. (maybe this is the API you want to hit from the web app?)

Authorization Server

Server that authenticates the Resource Owner and issues Access Tokens after getting proper authorization. example: Auth0 or Google.

User Agent

Agent used by the Resource Owner to interact with the Client (for example, a browser or a native application).

Scopes

They are your permissions

Access Token

Represents your current authorization

Refresh Token

Represents your next authorization

Grant Types

These are different flows representing how you retrieve tokens

• Authorization Code: for backend apps
• Implicit (deprecated) or Authorization Code with PKCE: for mobile apps and SPAs
• Client credential: service accounts and microservices
• Resource owner password: for legacy apps
• Device : for devices which can’t access browser example: kiosk

References

• Book: OAuth 2.0 simplified by Aaron Parecki
• oauth.com (maintained by Aaron)
  • oauth maps