Implementing OAuth2

Transcript

1. IMPLEMENTING OAUTH2
2. OAUTH2 OAuth is not a replacement for your Login system Used alongside existing login systems Used for external services, first and third party
4. GRANT TYPES
5. GRANT TYPES Authorization Code Password Client Credentials Refresh Token
6. PASSWORD • Simplified flow • Exchange username and password for access token • Not necessarily linked to user account
7. PASSWORD Parameter name Value Description client_id string API Client ID client_secret string API Client Secret grant_type string password username string Username password string Password
8. CLIENT CREDENTIALS • Third party – Server to server • Exchange a client_id and client_secret for an access token • Typically not linked to user account
9. CLIENT CREDENTIALS Parameter name Value Description client_id string API Client ID client_secret string API Client Secret grant_type string client_crede ntials scope string Requested scopes
10. AUTHORIZATION CODE • Third Party Access – User to Server • Send user to endpoint with client_id, response_type, state, redirect_url • ”Do you authorize DannyToplessApp to access your account” • If authorized, redirect to {redirect_url}?state={state}&code={auth_code} • Auth code can then by swapped for an access_token via the token endpoint
11. AUTHORIZATION CODE
12. Parameter name Value Description client_id string API Client ID client_secret string API Client Secret grant_type string authorization_ code code string Auth code that was retrieved from the authorize endpoint AUTHORIZATION CODE
13. REFRESH TOKEN • Renew an already established session with a new token
14. REFRESH TOKEN Parameter name Value Description client_id string API Client ID client_secre t string API Client Secret grant_type string refresh_toke n refresh_toke n string Refresh token
15. ACCESS TOKENS Limited lifespan, usually 60 minutes Revocable on the server side
17. IMPLEMENTATION
18. IMPLEMENTATION
19. IMPLEMENTATION
21. QUESTIONS?