OAuth at Logos

Transcript

1. OAuth all the things
2. What is OAuth? In a nutshell: A secure way for 3rd parties to use our APIs without ever handling our users’ username & password.
3. Is that it? Yes! (mostly) Using OAuth gives us some other advantages: Remote kill-switch in case a user is hacked Rate Limiting Analytics. Who is using what apps?
4. How does it work? There are three participants: The User The App The Server The goal is to never share private credentials between the user & the app.
5. Here we go! Marty McFly wants users to comment on his church’s blog using Faithlife. He registers his app, Hill Valley Baptist Church Blog at developer.faithlife.com, and hooks comments into his site.
6. The Consumer Key & Consumer Secret are like the ‘username’ and ‘password’ for the app itself.
7. A wild user appears! And they want to post an angry comment at their pastor on the blog. So they click on the ‘sign in with Faithlife!’ button. blog.hillvalley.com sends a message to our server saying “I have a user that wants to sign in, but I don’t know who they are yet.”
8. We say, no problem. And we give the app a temporary identifier to substitute for the user information until the user signs in. The App sends The User to a sign-in page that we provide. We tell the user what The App is allowed to do.
9. Meanwhile... The App is doing other stuff while waiting for The User to sign in. When The User gives permission, we send a Verifier that says that everything checks out OK.
10. Finally... The App sends the verifier to The Server along with the temporary token, and the server sends The App an Access Token & Access Secret. These substitute for the user’s username & password, and The App signs all of its API requests with these credentials.
11. A happy ending. The User may be angry at his pastor, but he won’t have to be angry about his Faithlife account being hacked.
12. The nitty gritty The OAuth server runs at: https://auth.logos.com/oauth/v1/ You can start building apps using the documentation and app registration facilities at: https://developer.faithlife.com/
13. Plug it in. We have OAuth clients implemented for Objective-C and C# in the OAuth repository. I built a small website written in Haskell that uses OAuth. The developer portal is written using Node, and uses OAuth for sign-in & registration.
14. Questions?