BY MUKTADIUR RAHMAN

OAUTH 2.0 OVERVIEW

AGENDA

• OAuth 2.0 • OpenID/OpenID Connect

OAUTH

• OAuth is an open standard for authorization. OAuth provides a method for clients to access server resources on behalf of a resource owner (such as a different client or an end-user). It also provides a process for end-users to authorize third-party access to their server resources without sharing their credentials (typically, a username and password pair), using user-agent redirections.

HISTORY

• OAuth 1.0 was developed in Oct 3,2007• OAuth 2.0 Framework and Bearer Token was

developed in Oct, 2012

TERMINOLOGY

• Authentication• Federated Authentication• Authorization• Delegated Authorization

ROLE

• Resource server• Resource owner• Client• Authorization server

PROTOCOL FLOW

OPENID

• OpenID is a decentralized authentication protocol that makes it easy for people to sign up and access web accounts• OpenID allows you to use an existing account to

sign in to multiple websites, without needing to create new passwords

• http://openid.net/specs/openid-authentication-2_0.html

OPENID CONNECT

• A protocol built on top of OAuth 2.0 to enable using the same identity to log in (authenticate)to multiple applications

DEMO