OAuth

Overview

OAuth 2.0 (Open Authorization) is a set of specifications that allow developers to delegate the authorization of their users to someone else. An OAuth flow refers to the sequence of steps and interactions between all parties to obtain an access token. The parties involved are:

• Resource owner. The entity who owns the resources the client wants to use.
• Client. The service interested in using resources owned by the resource owner.
• Authorization Server. The service the resource owner authenticates against.

Grants

A grant is a method or set of credentials used to request an access token. The grant type has an impact on how the overall OAuth flow behaves. There exist a number of additional parameters that influence how the access token is generated:

• client_id
  • An identifier used to identify the client.
• client_secret
  • A secret provided by the client to prove their identity.
  • Generated between the authorization server and client before an entity ever attempts to login.
• response_type and grant_type
  • The type of grant.
  • Which is used depends on the OAuth grant being leveraged.
• scope
  • The authorizations made available with the generated access token.

Authorization Code

The authorization code grant has a response_type of code. In this grant, the authorization server issues a short-lived authorization code to the client, usually using the resource owner as a proxy. The client can then exchange this (along with its client_id and client_secret) for an access token.

Password

The password grant has a grant_type of password. In this grant, the username and password are provided directly to the client. The client then forwards this to the authorization server.