A short discussion and brief understanding on OAuth 2.0 Authorization Framework. Focuses on world example.

1. OAuth 2.0 Authorization Framework
By : John Roca

2. ?

4. ?

5. OAuth 2.0 Authorization Framework
By : John Roca

6. Objectives
To give an eye opener to the audience about the authorization technology
in the web
To give the audience a basic understanding on how an authorization
framework does its job

7. Terminologies
Authentication
Authorization
User Credentials
User Resource / User Data / Resource
Resource Owner
Resource Server
Client

8. Agenda
A.Introduction
a. Traditional Client-Server Authentication Model
b. Roles
c. Protocol Flow
d. Authorization Grant
i. Authorization Code
ii. Resource Owner Password Credentials
B. Protocol Endpoints

9. A.Introduction
CLIENT
SERVER
Auth
Layer
Requests access /users
Denied request if not
Authenticated
Authenticated access to /users
Returns /users resource
Traditional client-server authentication model

10. A.Introduction
Traditional client-server authentication model
CLIENT
SERVER
Requests access /user
Denied request if not
Authenticated
Authenticated access to /user
Returns /user resource
Auth
Layer

11. Grading System Example
GRADING SYSTEM
( Shows grades in different
subject )
USERNAME
PASSWORD
LOGIN
Juan Grades
Science
: 87
Math
: 87
English
: 87
USER

12. Grading System Example
GRADING SYSTEM
( Shows grades in
different subject )
USERNAME
PASSWORD
LOGIN
Juan Grades
Science
: 87
Math
: 87
English
: 87
USER
GWA COMPUTING
SYSTEM?
How???

13. A.Introduction
GWA
COMPUTING
SYSTEM?
GRADING
SYSTEM /
SERVER
Auth
Layer
Requests access /users
Denied request if not
Authenticated
Authenticated access to /users
Shares Credentials
USER / RESOURCE
OWNER
Returns /users
resource
Traditional client-server authentication model

14. A.Introduction
Traditional client-server authentication model
GWA
COMPUTING
SYSTEM? GRADING SYSTEM
/ SERVER
Requests access /users
Denied request if not
Authenticated
Authenticated access to /users
Shares Credentials
User / Resource Owner
Returns /users
resource
Auth
Layer

15. A.Introduction
Sharing Credentials creates several problems:
Third-party applications are required to store the resource owner's
credentials for future use, typically a password in clear-text.
Third-party applications gain overly broad access to the resource owner's
protected resources, leaving resource owners without any ability to
restrict duration or access to a limited subset of resources.

16. A.Introduction
Resource owners cannot revoke access to an individual third party without
revoking access to all third parties, and must do so by changing the third
party's password.
Compromise of any third-party application results in compromise of the
end-user's password and all of the data protected by that password.

17. A.Introduction -> Roles
Resource Owner
Resource Server
Client
Authorization Server

18. A.Introduction -> Roles -> Resource Owner
Resource Owner
An entity capable of granting access to protected resource.
When a resource owner is a person, it is usually referred to as end-user.
USER

19. A.Introduction -> Roles -> Resource Server
Resource Server
The server hosting the protected resources, capable of accepting and responding to
protected resource requests using access tokens.
GRADING SYSTEM
/ SERVER

20. A.Introduction -> Roles -> Client
Client
An Application making protected resource requests on behalf of other resource owner and
with its authorization.
GWA COMPUTING
SYSTEM?

21. Client Registration (Client Types)
OAuth defines two client types, based on their ability to authenticate securely with the authorization
server:
Confidential
Clients capable of maintaining the confidentiality of their credentials or capable of secure
client authentication using other means.
(e.g clients implemented on secure server with restricted access to the client
credentials),
Public
Clients incapable of maintaining the confidentiality of their credentials and incapable of
secure client authentication about the client type.

22. A.Introduction -> Roles -> Authorization Server
Authorization Server
The server issuing access tokens to the client after successfully authenticating the resource
owner and obtaining authorization.
GRADING SYSTEM /
SERVER

23. A.Introduction -> Protocol Flow
Client
Resource Owner
Authorization
Server
Resource Server
( A ) Authorization Request
( B ) Authorization Grant
( C ) Authorization Grant
( D ) Access Token
( E ) Access Token
( F ) Protected Resources

24. A.Introduction -> Protocol Flow
Client
Resource Owner
Authorization
Server
Resource Server
( A ) Authorization Request
( B ) Authorization Grant
( C ) Authorization Grant
( D ) Access Token
( E ) Access Token
( F ) Protected Resources

25. Protocol Flow in Real World Situation
( A ) Give me the key of your car
( B ) It’s with key holder, I will give you a chit, show
this to key holder and ask for key.
( C ) Give me car key. Here is the chit of approve
from owner
( D ) Ok, This is accepted, here is the key
( E ) Give me car to repair, this is the key
( F ) Ok, have the car
Mechanic
Car Owner
Key Holder
Car Park

26. A.Introduction -> Authorization Grant
An authorization grant is a credential representing the resource owner’s
authorization ( to access its protected resources ) used by the client to
obtain an access token.
The OAuth specification has four (4) grants types:
Authorization code
Resource owner password credentials
Implicit
Client credentials

27. A. Introduction -> Authorization Grant -> Authorization Code
The authorization code is obtained by using an authorization server as an
intermediary between the client and resource owner.

28. Authorization a client using FB Account
USER
www.scribd.com
FB AUTHORIZATION SERVER
User visits a client
CLIENT
Redirects upon clicking login
with fb button
FB Server redirects back the
user to scribd.com

29. Authorization Code Grant
RESOURCE OWNER
USER-AGENT
( Browser / Google
Chrome Browser )
CLIENT
AUTHORIZATION
SERVER
(A) (C)
(B)
(A) Client Identifier & Redirection URI
(B) User Authenticates
(C) Authorization Code
(D) Authorization Code & Redirection URI
(E) Access Token (w/ Optional Refresh Token)

30. Authorization Code Grant
RESOURCE OWNER
USER-AGENT
( Browser / Google
Chrome Browser )
CLIENT
AUTHORIZATION
SERVER
(A) (C)
(B)
(A) Client Identifier & Redirection URI
(B) User Authenticates
(C) Authorization Code
(D) Authorization Code & Redirection URI
(E) Access Token (w/ Optional Refresh Token)

31. A. Introduction -> Authorization Grant -> Resource owner
password credentials
The resource owner password credentials ( i.e., username and password) can
be used directly as an authorization grant to obtain an access token.
Should be used only when there is a high degree of trust between the
resource owner and the client.

32. Resource Owner Password Credentials Grant
RESOURCE
OWNER
CLIENT
AUTHORIZATION
SERVER
(A) Resource Owner Password
Credentials
(B) Resource Owner Password
Credentials
(C) Access Token
(w/ Optional Refresh Token)

33. Facebook Native Application and Facebook
FB SERVER

34. Protocol Endpoints
The authorization process utilizes two authorization server endpoints:
Authorization Endpoint
Used by the client to obtain authorization from resource owner via user-agent
redirection.
Token Endpoint
Used by the client to exchange an authorization grant for an access token, typically
with client authentication.
As well as one client endpoint
Redirection endpoint

35. Web links
Demo OAuth 2.0
The OAuth 2.0 Authorization Framework
OAuth V.1.0 VS OAuth 2.0
Which OAUTH 2.0 Grant should I use?
Security Considerations
Notes :
OAuth2 + API Security By Amila Paranawithana