Your SlideShare is downloading. ×
0
3rd-Party Authn/Authz
3rd-Party Authn/Authz
3rd-Party Authn/Authz
3rd-Party Authn/Authz
3rd-Party Authn/Authz
3rd-Party Authn/Authz
3rd-Party Authn/Authz
3rd-Party Authn/Authz
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

3rd-Party Authn/Authz

1,255

Published on

A brief overview of the popular 3rd-party authentication and authorization methods and implementations used in web apps.

A brief overview of the popular 3rd-party authentication and authorization methods and implementations used in web apps.

Published in: Technology, Design
1 Comment
0 Likes
Statistics
Notes
  • Be the first to like this

No Downloads
Views
Total Views
1,255
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
0
Comments
1
Likes
0
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide

Transcript

  • 1. 3rd-Party Authn/Authz
    • OpenID
    • OAuth
      • Twitter
      • 3. Facebook
  • 4.
    • Centralized authentication
    • 5. Single identify throughout the Internet
    • 6. Returns: identifier (and optional data)
  • 7. Generic OpenID
    • User enters a URL
    • 8. Consumer “discovers” based on the URL
    • 9. Redirects to provider
    • 10. User authenticates with provider
    • 11. Redirects to consumer
    Lots of hashy stuff going on here. Discovery varies V1 to V2.
  • 12.
    • “Federated Login for Google Account Users”
    • 13. OpenID V2 + AX
    • 14. Single discovery URL for everybody
  • 15.
    • Users allow Site to perform actions on their behalf via Service, without needing your password to Service
    • 16. Returns: identifier and access token
  • 17. Generic OAuth
    • Site gets request token from Service
    • 18. Redirects User to Service
    • 19. User authenticates and authorizes
    • 20. Redirects to Site
    • 21. Site gets access token from Service
    All implementations are service-specific. Hashy stuff varies V1 to V2.
  • 22.
    • OAuth 1.0
    • 23. Has both authentication and authorization endpoints
    • 24. Access levels: read, read/write, read/write/private.
  • 25.
    • OAuth 2.0
    • 26. Very fine-grained permissions

×