Wherefore Art Thou, OAuth?
-
Upload
larry-halff -
Category
Technology
-
view
3.424 -
download
0
description
Transcript of Wherefore Art Thou, OAuth?
![Page 1: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/1.jpg)
Wherefore Art Thou, OAuth?
1
![Page 2: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/2.jpg)
What is OAuth?
2
![Page 3: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/3.jpg)
What is OAuth?
2
Your Valet Key for the Web
![Page 4: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/4.jpg)
What is OAuth?
2
Your Valet Key for the Web
Delegated Authentication Protocol
![Page 5: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/5.jpg)
What is OAuth?
2
Your Valet Key for the Web
Delegated Authentication Protocol
Yet Another Community-driven Protocol
![Page 6: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/6.jpg)
Use Case Zero
3
+
![Page 7: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/7.jpg)
Use Case Zero
3
+?
![Page 8: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/8.jpg)
Federated Sign In
4
![Page 9: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/9.jpg)
Federated Sign In
4
![Page 10: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/10.jpg)
API Access
5
![Page 11: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/11.jpg)
API Access
5
![Page 12: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/12.jpg)
Phishing
6
![Page 13: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/13.jpg)
Phishing
6
![Page 14: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/14.jpg)
Phishing
6
![Page 15: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/15.jpg)
Phishing
6
![Page 16: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/16.jpg)
Phishing
6
![Page 17: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/17.jpg)
Delegated Authentication
7
Grant 3rd Party Application access to account
User does not give 3rd Party Application credentials
Control 3rd Party Application access to account
![Page 18: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/18.jpg)
What Was Already Out There?
8
FlickrAuth
BBAuth
AuthSub
OpenAuth
Amazon Web Services
![Page 19: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/19.jpg)
The OpportunityManage API access to services with federated sign in.
Render the password anti-pattern obsolete, teach end users not to accept it, and reduce phishing opportunities.
Build a community standard useable by even the smallest consumers or service providers as well as the largest.
Standardize existing delegated authentication patterns already vetted by larger institutions.
Proliferate protocol libraries so the code to protect and access resources only had to be written once.
9
![Page 20: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/20.jpg)
Who Helped Develop OAuth?Ma.gnolia
Citizen Agency
Six Apart
Flickr
Yahoo
AOL
Stamen
Pownce
Jaiku
Yedda
Wesabe
10
![Page 21: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/21.jpg)
Use CasesPrimary: Three Legged
Secondary: Two Legged
11
![Page 22: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/22.jpg)
Three LeggedUsed to request permission to access a specific user’s protected resources
Requires Involvement of three parties: User, Service Provider, Consumer
Examples: Contacts import, photo printing, bookmark synchronizing, location sharing, shopping cart or account updates
12
![Page 23: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/23.jpg)
Two LeggedUsed to access public resources, yet provider is still able to manage access and usage for a consumer.
Used to access resource that are private to specific consumers.
Requires Involvement of only two parties: Service Provider and Consumer
Examples: searches for publicly accessible data, consumer validated super-user level access
13
![Page 24: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/24.jpg)
Who’s Using OAuth?Google
Yahoo!
MySpace
Netflix
SmugMug
Photobucket
Ma.gnolia
Fire Eagle
Brightkite
GetSatisfaction
Meetup.com
88 Miles
thmbnl
Praized
Yammer
Agree2
Ohloh
14
![Page 25: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/25.jpg)
Three Legged Contact Import
15
![Page 26: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/26.jpg)
Three Legged Contact Import
15
![Page 27: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/27.jpg)
Three Legged Contact Import
15
![Page 28: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/28.jpg)
Three Legged Contact Import
15
![Page 29: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/29.jpg)
Two Legged Public Search
16
![Page 30: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/30.jpg)
Two Legged Public Search
16
![Page 31: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/31.jpg)
Two Legged Public Search
16
![Page 32: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/32.jpg)
Two Legged Public Search
16http://paul.donnelly.org/2008/10/31/2-legged-oauth-javascript-function-for-yql/
![Page 33: Wherefore Art Thou, OAuth?](https://reader034.fdocuments.in/reader034/viewer/2022052321/54858e05b4af9f820d8b4e43/html5/thumbnails/33.jpg)
Two Legged Public Search
16http://paul.donnelly.org/2008/10/31/2-legged-oauth-javascript-function-for-yql/