This document summarizes building and using secure web services with OAuth. It discusses how OAuth allows users to control who accesses their private data on third party applications and APIs. OAuth provides a standard for third party authentication that is easy to implement and puts users in control of their data by allowing them to choose which applications can access it, without having to share passwords. The document provides examples of OAuth implementations with Google and Fire Eagle APIs and discusses OAuth libraries for various programming languages.

1. BUILDING AND USING SECURE WEB SERVICES WITH OAUTH Skillswap Goes Portable, November 25, 2008 Bruce Boughton [email_address] http://bruceboughton.me.uk http://lab.madgex.com/

2. web services are about data let’s think about data...

4. why?

5. CONTROL YOUR DATA Don't get locked into one vendor

6. Mash|ups < data > MORE INTERESTING http://pipes.yahoo.com/bruceboughton/skillswapmashup

7. RE-PURPOSE YOUR DATA in different contexts

9. Data should be available in STANDARD DATA FORMATS <xml/> POSH  JSON μ f

15. http://kecute.wordpress.com/2007/11/05/cat-computer-geek/

16. we need an easy , user-friendly standard for third party api security

24. one thing: OAuth != OpenID (but they do play nicely)

25. OpenID is authentication OAUTH IS ACCESS CONTROL

26. let’s get technical

27. Protected resources are exposed by service providers and used by consumer applications on behalf of users

28. e.g. My physical location is exposed by the Fire Eagle API and used by the Madgex Lab demo on my behalf

29. Consumer identity asserted using CONSUMER KEY and SECRET

32. Requests are SIGNED and include a TIMESTAMP and NONCE

33. This is just PLAIN OLD HTTP with added super powers

34. don’t worry, there are plenty of open source libraries

35. Ruby .NET Python PHP Java JavaScript Objective-C and more... http://oauth.net/code

36. do we have time for some code? OAuth.net library http://lab.madgex.com/oauth-net

41. QUESTIONS? OR BEER. Bruce Boughton [email_address] http://bruceboughton.me.uk http://lab.madgex.com/