1. OAuth 2.0 provides a framework for authorization that defines four client types (web servers, user-agents, native applications, and autonomous clients) and three authorization flows (authorization code, implicit, and client credentials). 2. The authorization endpoint uses HTTP requests to obtain authorization from the resource owner via user-agent redirection or prompting the client directly. The token endpoint exchanges authorization codes or refresh tokens for access tokens via HTTP POST. 3. Access tokens are used by clients to access protected resources by passing the token in the authorization header, URI query parameter, or form-encoded body parameter of a request.

1. Summary of OAuth 2.0 memo
(based draft 8 Spec)
2010/06/20
=ritou
1

2. Warning!
‫ ﻪ‬This document is summary of OAuth 2.0
spec at Draft 8.
2

3. Overview
‫ ﻪ‬Client Type and Profile
‫ ﻪ‬Endpoint
‫ ﻪ‬Resource Access
3

4. Client Type and Profile
‫ 4 ﻪ‬Client types
‫ﻩ‬ Web Servers
‫ﻩ‬ User-Agents
‫ﻩ‬ Native Applications
‫ﻩ‬ Autonomous Clients
4

5. Web Server Profile
‫ ﻪ‬Client Credential
‫ ﻩ‬Client ID
User-Agent AuthZ Server ‫ ﻩ‬Client Secret
‫ ﻪ‬Facebook
‫ ﻪ‬Diff with OAuth 1.0a
‫ ﻩ‬No Request Token
Web Client Protected
Resource
Characters
5

6. 6

7. User-Agent Profile
‫ ﻪ‬Client on User-Agent
‫ ﻩ‬Twitter : @anywhere
User-Agent AuthZ Server ‫ ﻩ‬Facebook : JavaScript-
Based Authentication
‫ ﻪ‬Client Credential
‫ ﻩ‬Client ID
Client in Protected
Browser Resource
‫ ﻪ‬Access Token as URI
Fragment Identifier
Characters
7

8. 8

9. Native Applications
‫ ﻪ‬External User-Agent : UA Profile
‫ ﻩ‬Use custom URI scheme
‫ ﻩ‬Polling UA window
‫ ﻪ‬Embedded User-Agent
‫ ﻩ‬Check URL Redirection
‫ ﻪ‬Prompt for user credential
‫ ﻩ‬ID/PW to Access Token
‫( ﻯ‬Username and Password Flow)
9

10. Autonomous Clients
‫ ﻪ‬Clients = Resource Owner
‫( ﻩ‬Client Credential Profile)
‫ ﻪ‬Exsisting Trust Relationship / Framework
‫( ﻩ‬Assertion Profile)
10

11. Client credential
‫ ﻪ‬Client credential
‫ ﻩ‬client identifier
‫ ﻩ‬client secret(option)
‫ ﻪ‬AuthN schemes
‫ ﻩ‬Request parameters
‫ ﻩ‬HTTP Basic authN
11

12. Endpoint
‫ ﻪ‬End-user authZ endpoint : Indirect
Communication
‫ ﻩ‬Obtaining End-User Authorization
‫ ﻪ‬Token Endpoint : Direct Communication
‫ﻩ‬ Authrorized Code2Access Token
‫ﻩ‬ Resource Owner Credentials2Access Token
‫ﻩ‬ Assertion2Access Token
‫ﻩ‬ Refresh Token
12

13. End-user authZ endpoint
‫ ﻪ‬Request format
‫ ﻩ‬HTTP GET
‫ ﻪ‬Request Params
‫ ﻩ‬type,client_id,redirect_uri,state,scope
‫ ﻩ‬Proposal to use request_url parameter
‫ ﻯ‬Request by Reference ver.1.0 for OAuth 2.0
13

14. End-user authZ endpoint
‫ ﻪ‬Response format
‫ ﻩ‬type = web_server : query parameters
‫ ﻩ‬type = user_agent : URI fragment identifier
‫ ﻪ‬Response params
‫ ﻩ‬type = web_server : code,state
‫ ﻩ‬type = user_agent :
access_token,expired_in,state
14

15. Token endpoint
‫ ﻪ‬Request format
‫ ﻩ‬HTTP POST
‫ ﻪ‬Request params
‫ ﻩ‬Client credential + Specific params
‫ ﻩ‬grant_type, scope
‫ ﻯ‬code, redirect_uri
‫ ﻯ‬username, password
‫ ﻯ‬assertion_type, assertion
‫ ﻩ‬refresh_token 15

16. Token endpoint
‫ ﻪ‬Response format
‫ ﻩ‬JSON
‫ ﻪ‬Response params
‫ ﻩ‬access_token, expires_in, refresh_token, scope
16

17. Accessing a Protected Resource
‫ ﻪ‬Params
‫ ﻩ‬Access Token
‫ ﻪ‬Method
‫ ﻩ‬The Authorization Request Header Field
‫ ﻩ‬URI Query Parameter
‫ ﻩ‬Form-Encoded Body Parameter
17

18. OLD SPEC
18

19. Username and Password Profile
‫ ﻪ‬Like Twitter xAuth
End-User AuthZ Server
Client Protected
Resource
Characters
19

20. Client Credentials Profile
‫ ﻪ‬Like OAuth Consumer
Request (2-legged
AuthZ Server
OAuth Request)
Client Protected
Resource
Characters
20

21. Assertion Profile
‫ ﻪ‬SAML etc...
AuthZ Server
Client Protected
Resource
Characters
21