March 19th, 2013

OAuth 2.0Andreas Åkre Solberg, UNINETT AS

Client

Resource serverAuthorizationserver

Token storage

Feide

Resource owner(with browser)

authenticates gran

t

issues token acce

ssing

pr

otecte

d api

Authorization codeflow

browser

Resource serverAuthorizationserver

Token storage

Feide

Resource owner(with browser)

authenticates

grant

issues token

acce

ssing

prote

cted a

pi

Implicit grantflow

✤ Authorization Code

✤ Implicit Grant

✤ (Resource Owner Password Credentials)

✤ (Client Credentials)

✤ Accessing protected API

✤ How do we obtain the token?

Client

Resource serverAuthorizationserver

Token storage

Feide

Resource owner(with browser)

authenticates gran

t

issues token acce

ssing

pr

otecte

d api

✤ Authorization Request

✤ User authenticates

✤ User accepts client grant

Authorization Code Flow

Client

Resource serverAuthorizationserver

Token storage

Feide

Resource owner(with browser)

authenticates gran

t

issues token acce

ssing

pr

otecte

d api

✤ Access token request

✤ Access token response

Client

Resource serverAuthorizationserver

Token storage

Feide

Resource owner(with browser)

authenticates gran

t

issues token acce

ssing

pr

otecte

d api

✤ Authorization Request

✤ User authenticates

✤ User accepts client grant

Implicit Grant Flow

browser

Resource serverAuthorizationserver

Token storage

Feide

Resource owner(with browser)

authenticates

grant

issues token

acce

ssing

prote

cted a

pi

Client

Resource serverAuthorizationserver

Token storage

Feide

Clientstorage

ClientManagement

Client owner(with browser)

Resource owner(with browser)

UWAP

Client

Resource server

Authorizationserver

Token storage

Feide

Clientstorage

ClientManagement

Clientowner

SOAGatekeeper