A little presentation on OAuth2 authentication

1. OAuth2
Authentication
Ismael Gomes Costa

2. A little of history
HTTP Basic Authentication
Ismael Gomes Costa
Pros
● Easy to implement
● Small systems
Cons
● Only username/password
● Hard to integrate
● No distinction between users and
machines

3. The world changed...
OAuth1 Authentication
Ismael Gomes Costa
POST /oauth/request_token HTTP/1.1
User-Agent: themattharris' HTTP Client
Host: api.twitter.com
Accept: */*
Authorization:
OAuth oauth_callback="http%3A%2F%2Flocalhost%2Fsign-in-with-twitter%2F",
oauth_consumer_key="cChZNFj6T5R0TigYB9yd1w",
oauth_nonce="ea9ec8429b68d6b77cd5600adbbb0456",
oauth_signature="F1Li3tvehgcraF8DMJ7OyxO4w9Y%3D",
oauth_signature_method="HMAC-SHA1",
oauth_timestamp="1318467427",
oauth_version="1.0"

4. The world changed...
OAuth1 Authentication
Ismael Gomes Costa
Pros
● One user to many systems
● You don't have to save session
information on the server
● revoke access to an application
Cons
● Hard to implement
● You can't save additional information about
user on the server
● No specification about authentication out of
web

5. The world changed...
OAuth2 Authentication
Ismael Gomes Costa
Pros
● Mobile, web, desktop, webpage
● It’s simple to implement
● additional information about user
on the server
● No session
Cons
● Control of token refresh
● Security depends of HTTPS
and client library

6. Ismael Gomes Costa

7. Ismael Gomes Costa
Grant Types
● PASSWORD
● IMPLICIT
● CLIENT_CREDENTIALS
● AUTHORIZATION_CODE
● Whatever you want

8. Ismael Gomes Costa
Request Body
{
“grant_type” : “password”,
“client_id” : “12431245”,
“username” : “root”,
“password” : “123”,
}

9. Ismael Gomes Costa
Response Body
{
"access_token":"2YotnFZFEjr1zCsicMWpAA",
"token_type":"example",
"expires_in":3600,
"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
"example_parameter":"example_value"
}

10. Ismael Gomes Costa
References
https://tools.ietf.org/html/draft-ietf-oauth-v2-31
http://oauth.net/2/
http://oauthbible.com/

11. Ismael Gomes Costa
thanks!