Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I read about Oauth2, mostly in the context of social media service providers like Google, Facebook, Twitter where they

  1. Try to allow access to user data without giving password to third party applications.
  2. Allow to use service without explicitly creating an account (StackExchange allows login through Google, Yahoo etc account)

Now, is Oauth2 relevant if I have the following use case. I have an application, which is possibly deployed in cloud and provide a SAS model of business. I need user to create account (may be through an existing Oauth2 account), but also need to add other user to their account and manage access based on role. I read scope can be used for specifying roles and fine grained access. But, I wonder whether Oauth2 is meant of enterprise use like these or almost exclusively for social media model of applications.

Thank you. bsr.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

The OAuth protocol is flexible to enough to be used in as a general purpose federated authentication system, and this was the original intent behind the OAuth specification. It just so happens federated authentication systems are also useful for social media sites.

CAS is a less popular SSO architecture that is used by businesses and schools.

share|improve this answer
    
so does that mean, oauth2, CAS etc just deal with authentication, and role based access and user management is always built on top of it. thanks –  bsr Jun 22 '13 at 13:12
    
@bsr Yes, that is correct. –  Rook Jun 22 '13 at 19:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.