Introduction to OAuth2

2. @seanw122

3. Who are you?
Authentication
Authorization
What can you
access?

4. OAuth is about Authorization
After the user is authenticated
resources can then be accessed.

5. OAuth is about Authorization
resources can then be accessed.
After the user is authenticated

6. Roles
Grant Types / Flows
Example
Tools
Getting Started
More Learning

7. Roles
“Resource Owner”
User

8. Roles
Resource
Server

9. Roles
Authorization
Server

10. Roles
Client

11. Grant Types
“Server”
Primary type used. Can be for Web Apps,
Browser based app, and mobile apps.

12. Grant Types

13. Grant Types

14. Grant Types
Grants access token and does not use a secret.
Used by some mobile apps and web applications.
Replaced by Authorization Code without a secret.

15. An Example
Authorization Code

17. Please login
CancelOk
User Name
Password

18. This application would
like to access your profile
and files.
DenyAllow

19. CancelOk

20. Application
(client)
Authorization
Server
1.
8.
9.
2.
When user logs into
Authorization Server
and allows the application
to use the resources the
application receives a one
time use code.
3.
7.
4.
6.5.
Browser
seans_fake_app.com

21. Application
(client)
Authorization
Server
1.
2.
Here the
application can
store the user
information along
with their
associated access
token information.

22. Application
(client)
Resource
Server
1. 2.Now the application can
access allowed
resources on behalf of the user
using the access token.

24. getpostman.com

25. telerik.com/fiddler

26. curl.haxx.se

27. https://developers.google.com/oauthplayground

28. https://developers.google.com/identity/choose-auth

29. console.developers.google.com

30. developers.google.com/identity/protocols/googlescopes#drivev3

31. https://developers.google.com/drive/v3/reference/files/list

32. aaronparecki.com/oauth-2-simplified
digitalocean.com/community/tutorials/an-introduction-to-oauth-2
alexbilbie.com/guide-to-oauth-2-grants

33. manning.com/books/oauth-2-in-action
packtpub.com/application-development/mastering-oauth-2