New answers tagged

2

OAuth is like any other auth scheme with regard to its functional purpose. You send creds to it, and it returns user info (even if it's only success/fail messages). Usually a standards based auth server is used by multiple applications so you really want it isolated to it's own functional domain, code base and host. You don't want changes made to an ...


0

SAML and OAuth 2 are protocols for authentication/authorization. JSON Web Tokens (JWT) is a specification for a token that can be used in many applications or protocols - it also happens that the OpenID Connect (OIDC) protocols uses the JWT standard. SAML also defines its own token: SAML Assertion; as does OAuth 2: Access Token. Tokens are used by ...


1

Even though the connection between user agent and servers are secure, the user agent may not be fully protected. Since authorization code flow ensures the user agent is not privy to the tokens, security is improved by reducing exposure of tokens to between servers only.


1

OpenID Connect is a profile of OAuth2... defining an architecture that enables a person to authorize an identity provider to release certain user claims to a client (website / mobile application). OAuth2 offers the Resource Owner Password Credential Grant, which is rightly maligned by IAM experts as "The Devil". A common pattern for OpenID Connect API is ...


0

Requirement of a client secret implies that the client is trusted by the authorization server, and typically only server-side services can be trusted by an authorization server. Generally speaking, you don't want potentially untrustworthy clients like Mobile devices or Web browser to possess refresh tokens. This is why OAuth 2 implicit flow does not support ...


1

... since when the client wants to obtain an access token using the refresh_token grant type, it MUST send a client ID and a secret key in the body of the request... According to RFC 6749 this statement is not entirely true. The refresh token is the only information a client needs to obtain a new access token. However this is only the case for public ...


1

Refresh_tokens are optionally generated alongside access_tokens by the authorisation service. The access_token is usually short lived (by comparison) and is solely used to gain access to whatever resource is required. Once the Access_token has naturally expired, then the refresh_token is used with the authorisation server to gain another access_token. ...


1

Short answer is that it is undefined. If you want a library that supports both, ensure it explicitly states it supports both OAuth 2 and OIDC. If you were to draw a Venn diagram, OAuth 2 and OIDC intersect each other but OAuth 2 also defines some flows that OIDC does not extend, and OIDC adds a flow that is not in OAuth 2. OAuth 2 flows: Authorization ...


0

This is something I've been wondering about as well. I don't think a solution exists right now, but I believe new systems can be designed to do this without downtime by leveraging Trust Assertions for Certificate Keys (TACK) to do so. When the client decides to cycle to a new secret we need a mechanism to ensure the server can trust the new secret. In other ...


1

According to section 2 - client registration a client is registered with the authorization server before initiating any of the flows. Client registration includes specifying the client type (confidential or public), and is subsequently assigned a client ID. So when the authorization server receives a request for a given client ID, it knows whether it is ...


1

The main issue is making sure that you protect against the confused deputy problem. Imagine you are using OAuth to authenticate users within your application. However, an evil developer has their own application which also uses OAuth. Say their application is a Solitaire game, which uses Google's OAuth API. A user authenticates for Solitaire using their ...


0

Giving an app your OAuth token is kind of like giving them a limited-use password. In this case it's a password they they can use to get into your Google Drive, but they can't use it to get into your Gmail. If you're not comfortable with the app saving that key to storage, then don't use that app. Also, you can review which OAuth tokens you've granted and ...


0

As mentioned in other answers, basically you need a unified Identity management system. Disclaimer: The company that I work for has a product which provides identity services. I would not trust a person's StackOverflow answer to decide which system is best suited to my needs. These systems are fairly expensive and people usually request proposals ...


0

What it seems like you are asking about is an Identity and Access Management (IDAM) solution which offers federated authentication from non-university sources. I've only dealt with proprietary solutions (Oracle, CA etc..) but generally IDAM solutions are made up of the following elements: - Authentication - Access Control - User Management - User repository ...


1

You are looking for an "API Gateway." Many API gateway products and services are available. This StackOverflow answer lists some of the options: http://stackoverflow.com/a/11335822/650894 In addition, Amazon offers their own API gateway, which looks to have pretty flexible deployment options: https://aws.amazon.com/api-gateway/ I've also encountered the ...



Top 50 recent answers are included