What is the name of this token-authentication scheme?

Question

I'm working on a specific security design. When reading it, it looks like some form of OATH but I'm not sure which kind.

The scheme is as follows:

1. The client authenticates through a web-portal (authorization server) with username password.
2. After a successful authentication, the user is forwarded to the resource-owner, the request contains a token.
3. The resource-owner validates the token with the authorization server.
4. The authorization server tells who the corresponding user is.

Now my question is: What is this schema called?

+--------------+                                +---------------+
|              |                                |               |
|              |       1. sends user & pass     |  authorization|
|   client     | +----------------------------> |  server       |
|              |                                |               |
|              |                                |               |
|              |                                |               |
|              |                                |               |
+--------------+                                +----^------+---+
                                                     |      |
                                                     |      |
                                   3. validates if   |      | 2. if correct, credentials
                                   256 bit string is |      | forwarded as 256 bit string.
                                   valid.            |      |
                                                     |      |
                                                +----+------v---+
                                                |               |
                                                |  resource     |
                                                |  owner        |
                                                |               |
                                                |               |
                                                |               |
                                                |               |
                                                +---------------+

UPDATE:

I hope my use case will clarify a bit more. I can only make minor changes to the resource owner (for a variety of non-tech related issues) and the type of authentication I want (two-factor) is not a minor change. So I want the authentication server to redirect (after a successful authorization) the client to the resource owner ([512 bit string] POSTed to https://www.resource-owner.com/)/. Now the resource owner asks the authorization server: is this token valid and for which user? It will return the user id is valid.
- The token expires after 5 seconds.
- The token is just a token, there is nothing encrypted inside of the token.

Answer 1

It sounds similar to OAUTH but the token usually contains basic attributes, including the user identity. You need to make sure that whatever the token contains cannot be modified, this can be done through validating a signature or using an HMAC.

I wouldn’t recommend reinventing the wheel here, just implement OAUTH.