The document discusses the history and evolution of OAuth authentication standards. It describes OAuth1 which introduced the concept of authorizing access to user accounts without sharing usernames and passwords. OAuth2 improved on OAuth1 by supporting additional platforms beyond web and allowing additional user information to be stored by the authorization server. OAuth2 defines common grant types like authorization code, password, and client credentials flows. It also outlines the basic request and response formats involving access tokens.

1. OAuth2
Authentication
Ismael Gomes Costa

2. A little of history
HTTP Basic Authentication
Ismael Gomes Costa
Pros
● Easy to implement
● Small systems
Cons
● Only username/password
● Hard to integrate
● No distinction between users and
machines

3. The world changed...
OAuth1 Authentication
Ismael Gomes Costa
POST /oauth/request_token HTTP/1.1
User-Agent: themattharris' HTTP Client
Host: api.twitter.com
Accept: */*
Authorization:
OAuth oauth_callback="http%3A%2F%2Flocalhost%2Fsign-in-with-twitter%2F",
oauth_consumer_key="cChZNFj6T5R0TigYB9yd1w",
oauth_nonce="ea9ec8429b68d6b77cd5600adbbb0456",
oauth_signature="F1Li3tvehgcraF8DMJ7OyxO4w9Y%3D",
oauth_signature_method="HMAC-SHA1",
oauth_timestamp="1318467427",
oauth_version="1.0"

4. The world changed...
OAuth1 Authentication
Ismael Gomes Costa
Pros
● One user to many systems
● You don't have to save session
information on the server
● revoke access to an application
Cons
● Hard to implement
● You can't save additional information about
user on the server
● No specification about authentication out of
web

5. The world changed...
OAuth2 Authentication
Ismael Gomes Costa
Pros
● Mobile, web, desktop, webpage
● It’s simple to implement
● additional information about user
on the server
● No session
Cons
● Control of token refresh
● Security depends of HTTPS
and client library

6. Ismael Gomes Costa

7. Ismael Gomes Costa
Grant Types
● PASSWORD
● IMPLICIT
● CLIENT_CREDENTIALS
● AUTHORIZATION_CODE
● Whatever you want

8. Ismael Gomes Costa
Request Body
{
“grant_type” : “password”,
“client_id” : “12431245”,
“username” : “root”,
“password” : “123”,
}

9. Ismael Gomes Costa
Response Body
{
"access_token":"2YotnFZFEjr1zCsicMWpAA",
"token_type":"example",
"expires_in":3600,
"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
"example_parameter":"example_value"
}

10. Ismael Gomes Costa
References
https://tools.ietf.org/html/draft-ietf-oauth-v2-31
http://oauth.net/2/
http://oauthbible.com/

11. Ismael Gomes Costa
thanks!