Cyberstudy
PDF p.110 In progress

Open Authorization (OAuth)

Open PDF at p.110 20 flashcards

Summary

PDF p.110

Open Authorization (OAuth) is a protocol used for authentication and authorization in RESTful APIs, facilitating the sharing of user profile information between sites without sharing passwords. OAuth uses tokens to grant access to resources hosted on resource servers, managed by authorization servers.

In plain words

Supplementary — not from your PDF

OAuth lets you allow one app to use part of your account on another service without giving it your password. The app gets an access token, often a JWT, from an authorization server and presents it to the resource server (API).

Detailed explanation

PDF p.110
  • RESTful APIs
    • Definition: APIs based on Representational State Transfer (REST), offering more flexibility than SOAP.
    • Support: Better support for mobile apps compared to SOAP and SAML.
  • OAuth Protocol
    • Purpose: Facilitates sharing of user profile information between sites without sharing passwords.
    • User Account: Created at an identity provider (IdP) and linked to OAuth consumer sites.
    • Authorization: Users (resource owners) grant OAuth clients (apps or consumer sites) access to parts of their account.
  • Components
    • Resource Server (API Server): Hosts functions allowing OAuth clients to access user attributes.
    • Authorization Server: Processes authorization requests, managing multiple resource servers or being the same instance.
  • Client Registration
    • Process: Client app/service registers with the authorization server, providing a redirect URL, client ID, and secret.
    • Client ID and Secret: ID is public; secret is confidential.
  • Authorization Process
    • Request: Client requests authorization; user approves via the authorization server.
    • Grant Types/Flows: Different contexts (e.g., server to server, mobile app to server).
    • Access Token: Validated by the authorization server, presented to the resource server for access.
  • JSON Web Token (JWT)
    • Format: Used for claims data in OAuth.
    • Transmission: Passed as Base64-encoded strings in URLs and HTTP headers.
    • Security: Can be digitally signed for authentication and integrity.

Important terms

taken from the text above
RESTful APIs
APIs based on Representational State Transfer (REST), offering more flexibility than SOAP.
Support
Better support for mobile apps compared to SOAP and SAML.
User Account
Created at an identity provider (IdP) and linked to OAuth consumer sites.
Authorization
Users (resource owners) grant OAuth clients (apps or consumer sites) access to parts of their account.
Resource Server (API Server)
Hosts functions allowing OAuth clients to access user attributes.
Authorization Server
Processes authorization requests, managing multiple resource servers or being the same instance.
Client ID and Secret
ID is public; secret is confidential.
Request
Client requests authorization; user approves via the authorization server.
Grant Types/Flows
Different contexts (e.g., server to server, mobile app to server).
Access Token
Validated by the authorization server, presented to the resource server for access.
Transmission
Passed as Base64-encoded strings in URLs and HTTP headers.
REST Representational State Transfer JWT JSON Web Token

Examples & real-world scenarios

Supplementary — not from your PDF
  • Letting a calendar app read (not change) your email calendar.
  • An app registered with a client ID (public) and secret (confidential).
  • JWTs carrying claims, signed for integrity.

Scenario

A fitness app asks to 'view your profile and contacts'. The user approves only the profile scope. The app gets a token limited to that, and never sees the user's password.

Common mistakes

Supplementary — not from your PDF
  • Calling OAuth an authentication protocol by itself. It's about delegated authorization.
  • Leaking the client secret in mobile app code.

Practical skills

Supplementary — not from your PDF
  • Explain the roles in an OAuth flow: resource owner, client, authorization server, resource server.

What I should remember

Key Points PDF p.110
  • RESTful APIs
    • Flexibility: More implementation choices.
    • Mobile Support: Better than SOAP/SAML.
  • OAuth Protocol
    • Purpose: Share user profile information securely.
    • User Account: Linked to OAuth consumer sites.
    • Authorization: Granted to OAuth clients.
  • Components
    • Resource Server: Hosts API functions.
    • Authorization Server: Manages authorization requests.
  • Client Registration
    • Redirect URL: Endpoint for authorization tokens.
    • Client ID/Secret: ID is public; secret is confidential.
  • Authorization Process
    • Request and Approval: User approves client request.
    • Grant Types: Various contexts.
    • Access Token: Validated and used for resource access.
  • JSON Web Token (JWT)
    • Format: For claims data.
    • Transmission: Base64-encoded strings.
    • Security: Digitally signed.