Tag Info

New answers tagged

1

The answer is yes. Why? Because it is what OAuth is intended to fulfill: delegation of (a secure) access to a user (B) for a resource on behalf of a resource owner (A). I think the description in this draft will be quite straightforward to you: (A) The client requests authorization from the resource owner. The authorization request can be made ...


1

After reading the linked blog post and after cross referencing his issues with the OAuth 2.0 RFC I have a few issues with his concerns. In the first section of his blog post, he has two major issues with using OAuth within a single page web application using the Resource Owner Password Credentials Grant: The client_id and client_secret are baked into the ...


0

To your questions: [...] I don't have ability for user to login with social network accounts and other Oauth2 servers in the network [...]. You will need your own OAuth authorisation server, that will manage your resource server. The OAuth server from Google, Facebook, Twitter, etc., will not help because, as far as I know, can only grant ...


2

First, you need to understand that OpenID connect is built on top of OAuth 2. That is, you need to understand the differences of the Authorization server, the resource server, the client and the user. In general the idea is: a user wants to use a client application but he/she has to login first the client application trusts an authorization server, the ...


0

You're correct, this is possible if the mail provider offers a mechanism to access user email using OAuth 2.0. However, not all online mail providers allow full IMAP access using an OAuth 2.0 token. From a quick glance around the web the only provider I found that allowed full IMAP access was Google. Office365 and Yahoo both only allow user email access ...


1

Bear in mind that when you enable third-party account authentication in your application it is because you're delegating Identification AND Authentication to that third-party, that you choose to trust. For instance, if the user chooses to login to your application using a third party account, your application doesn't have to be aware when the user changes ...


1

Probably not. The information provided by that endpoint is fairly deterministic in nature, so anyone with enough motive (e.g. has 20 minutes to kill) can guess the details and generate the same password as you for that user. Additionally, that hash will fail every time (or often enough) a new token is issued, so you need to always keep the record updated. ...


1

First off, as you probably know, OpenID Connect is just an authentication layer built on top of OAuth2. So regardless of which on you pick, you will need to implement OAuth2 (as the common denominator). OAuth2 itself is an authorization mechanism (i.e. allows you to check that a token is valid and has a specific set of scopes granted). It does not provide ...


1

From what you have explained it seems that OAuth 2.0 would better suit your needs. OpenID Connect was developed to add secure authentication to OAuth 2.0. Large providers i.e. Google, Facebook, Yahoo, etc began using OAuth 2.0 as a way to authenticate users with "login with" services so users could use their credentials to authenticate to a variety of ...



Top 50 recent answers are included