Upgrade to Pro — share decks privately, control downloads, hide ads and more …

OAuth 101

C7f3b4756d808ef0e2548bd0965ac225?s=47 Nick Jackson
February 20, 2012

OAuth 101

A crash course on the basics of OAuth which I gave at Dev8D 2012.


Nick Jackson

February 20, 2012

More Decks by Nick Jackson

Other Decks in Technology


  1. None
  2. Nick Jackson Web Monkey University of Lincoln @jacksonj04

  3. Story time!

  4. I’m a user of a web service

  5. I own resources on the web service

  6. For example, personal details

  7. None
  8. These resources1 are stored on a resource server 2 1.

    personal details 2. facebook.com
  9. The resource server exposes user resources over an API

  10. I visit a 3rd party web application

  11. The 3rd party web app is called a client

  12. The client1 wants to use my resources2 1. 3rd party

    web app 2. personal details
  13. But the resource server’s API requires user authorisation

  14. How?

  15. Give the client my password

  16. Give the client my password

  17. So what then?

  18. OAuth

  19. “An open protocol to allow secure API authorisation in a

    simple and standard method from desktop and web applications.” oauth.net
  20. —˛

  21. User Client Resources Owns Accesses Authorises

  22. The flow

  23. User clicks “sign in” in the client application

  24. None
  25. The user is redirected to the resource server and asked

    to sign in
  26. None
  27. GET /authorise? response_type=code&client_id=12345&redirect_uri= http://client.tld/ redirect&scope=name,email,birthday HTTP/1.1 Host: resource-server.tld

  28. The resource server clearly tells the user the specific data

    the client wants to access
  29. None
  30. User authorises the application and is redirected back to client

    with a authorisation code in the query string
  31. HTTP/1.1 302 Found Location: http://client.tld/redirect?code=78dsf9sudfo9s

  32. Client exchanges the authorisation code for an access token

  33. POST /token HTTP/1.1 Host: resource-server.tld Content-type: application/x-www-form-urlencoded code=78dsf9sudfo9s&client_id=12345&client_secret =12345&redirect_uri=http://client.tld/redirect

  34. HTTP/1.1 200 OK Content-type: application/json { access_token: “aLKJHskjhda8s13jsi9sis”, valid_until: 1320759526

  35. The access token can then be used as authorisation by

    the client to access the specified resources for a specific length of time
  36. Advantages

  37. No password sharing <- Happy security conscious user

  38. Developers just need to implement a redirect and a POST

    request <- Happy developers
  39. Users can revoke access tokens for specific clients

  40. None
  41. Nefarious clients can have their credentials revoked and all associated

    access tokens destroyed immediately
  42. None
  43. None
  44. Currently version 1.0a lncn.eu/giy

  45. Version 2.0 is almost finished lncn.eu/bkw

  46. OAuth 2.0 •Simpler •Requires all communication over SSL •New flows

    •Better UX
  47. Who’s using OAuth?

  48. None
  49. And in HE?

  50. None
  51. None
  52. None
  53. data.lincoln.ac.uk people energy location printing events calendars bibliographic documents

  54. Internal and external authorisation

  55. Open source 2.0 server lncn.eu/ar6

  56. Any questions?

  57. Thank you @jacksonj04