Open Authorization is an open standard for token-based authentication and authorization on the Internet.

1. OAuth 2
Mohamed Ahmed Abdullah

2. Google Calendar Dilemma
Mohamed
Secret 123

3. Import Contact
ESPN
Facebook

4. What is the Solution?
X
Clients ScopesAuthorization Server

5. In Reality(Mobile)

6. In Reality(website)

7. The ImplicitFlow
IdentityServer Resources Host Client
(DesktoporMobile)
Resource Owner
Pressing theLogin Button
ClientId andRedirectionURI
ClientX wanttoaccess A,BandC (Scopes)
OK
Access Token
Get,Using BearerAccess Token
Is this TokenLegitimate
Yes
HerearetheResources

8. The ImplicitFlow
https://identityserver.sudatel.sd/identityServer/identity/connect/consent?client_id=tripgalleryimplicit&redirect_uri
=https%3A%2F%2Fidentityserver.sudatel.sd%2FIdentityServerClient%2Fcallback.html&response_type=token&sco
pe=gallerymanagement
LoginRedirection
Location:https://identityserver.sudatel.sd/IdentityServerClient/callback.html#access_token=eyJ0e…900Char
…….NGg&token_type=Bearer&expires_in=20&scope=gallerymanagement
WhenFinish From authorizationtheIdentityServer Redirect to This Location

9. AuthorizationCode

10. IdentityServer Resources Host
Client
Resource OwnerServerSide Client Side (Browse)
Pressing theLogin Button
ClientId andRedirectionURI
ClientX wanttoaccess A,BandC (Scopes)
OK
AuthorizationCode
AuthorizationCode +Client Secret
AuthorizationToken+RefreshToken
AuthorizationToken
as cookie
Get,Using BearerAccess Token
Is this TokenLegitimate
Yes
HerearetheResources

11. Thedifferences between ImplicitFlowandAuthorizationCode
• Implicitforuntrusted clients (Mobile, Desktop,Angular) AuthorizationCodeFor Servers (Web Sites, APIs)
• Implicitaccessexpire fast
• Inthe implicitnouse forthe client secret
• Implicitdon’thave refresh token

12. Resource OwnerPassword Flow
• Theclient ishighlytrusted
• TheAppRemove thePassword after getting thetoken

13. ClientCredentialFlow
• Theclient wanttoaccesshis data,notthe User’s Data
• Shouldbe used onlyifyouhaveaserver. youcan’tdoit fromuntrusted sources

14. What is bad about OAuth
• Interoperability
• You can’t write one peace of code that woks for all. Discover endpoints and log on toone of them
• Inthe Implicit flow, the redirect URIshould be something odd to preventthe Browserfrom requestingit.

15. Whento Use OAuth
• Single Sign On
• Scalable Solution (Manyserver)because it’s a stateless Authentication
• Content Providerlike (Facebook,…)
• Whenyou have 3 entities, yourAPI, one ofyouruserswant to accessotheruser’sdata
• Best Solution For Authorization

16. Thanks To
EranHammer

17. References and Resources
• https://github.com/IdentityServer/IdentityServer3
• Getting Started with OAuth2.0
• https://www.pluralsight.com/

18. Any Question?

19. How to setup OAuth
1. http://oauth.net/2/ .NET, JAVA, PHP, Python,NodeJS, Ruby, ….
2. For .Net get it form https://github.com/IdentityServer/IdentityServer3
3. I Recommend to usereal certificate for yourdevelopment, it will speed up the process
4. Changethe Constant ProjectURIsto Fit yourURIs
5. Build the Identity Serverand the ResourcesHost
6. InstallFiddler and Wiresharkto help you debug your application
7. At the development you canusein memory Usersand Clients, but then you havetosetup the Databases
8. Thenyou canstart With yourdeveloping APIs