I'm trying to implement OAuth 2.0 and I noticed in the spec they mention two servers - an auth server to pass access tokens back to and a resource server to use the access tokens on.
My question is, how important is it to have two servers for this? Is it one of those things where it'd be perfectly fine to use one server for both jobs and separating them out is for added security or is it absolutely critical to have two servers for this?
OAuth is like any other auth scheme with regard to its functional purpose. You send creds to it, and it returns user info (even if it's only success/fail messages).
Usually a standards based auth server is used by multiple applications so you really want it isolated to it's own functional domain, code base and host. You don't want changes made to an application to impact an auth server that other applications use. That could be disastrous in a production environment and adds more QA than you should need for changes to the app.
If it will never be used by other applications there's no reason to add that layer of complexity that OAuth will add to the mix.
So yea separation should be there if OAuth is planned. In fact your OAuth server should be it's own project.
