OAuth is an open protocol that enables secure API authorization for applications without requiring users' credentials. It works as a method for both authentication and authorization, often used in scenarios involving third-party access to user data. The document discusses the integration of OAuth with other technologies and mentions its community and implementations across various programming languages.

1. OAuth
Simone Tripodi - Asemantics S.r.l.
stripodi@asemantics.com

2. What’s OAuth?
• An Open Protocol to allow secure API
authorization in a simple and standard
method for mobile, desktop and web
application;
• a protocol for developing password less
APIs;
• a way for an application to interact with an
API on a user’s behalf without knowing the
user’s authentication credentials.

3. Hypothetical Scenarios
“Import pictures from Picasa “Allow Dailymotion read
into Virgilio Photo Album” Virgilio’s User data”
End User End User
Service
Consumer Service
Provider
Consumer Provider

4. Authorization flow

5. B2B shared information
• Consumer Key: a value used by the
Consumer to identify itself to the Service
Provider;
• Consumer Secret: a secret used by the
Consumer to establish ownership of the
Consumer Key;
• The Consumer establishes a Consumer Key
and a Consumer Secret with the Service
Provider to be authenticated; the Consumer
needs to be registered!

6. OpenID & OAuth
• OpenID: helps determine who you are -
AUTHENTICATION;
• OAuth: defines how to give access to
protected data - AUTHORIZATION;
• They are complementary; a site that
supports OAuth could also support
OpenID for authentication!!!

7. OpenID & OAuth:
Example integration

8. OAuth is
Production Ready!!!
• Google
• Yahoo!
• MySpace
• Digg
• Twitter
• Magnolia
• Plaxo
... and much more!

9. OAuth community
• Leaded by Brian Cook & Chris Messina;
• Active Google-group:
http://groups.google.com/group/oauth/
• Blog: http://blog.oauth.net/
• Many available implementations from OS
communities:
Java - C# - JavaScript - Perl - PHP ...

10. Where are we?
here