I'm working on a specific security design. When reading it, it looks like some form of OATH but I'm not sure which kind.

The scheme is as follows:

  1. The client authenticates through a web-portal (authorization server) with username password.
  2. After a successful authentication, the user is forwarded to the resource-owner, the request contains a token.
  3. The resource-owner validates the token with the authorization server.
  4. The authorization server tells who the corresponding user is.

Now my question is: What is this schema called?

+--------------+                                +---------------+
|              |                                |               |
|              |       1. sends user & pass     |  authorization|
|   client     | +----------------------------> |  server       |
|              |                                |               |
|              |                                |               |
|              |                                |               |
|              |                                |               |
+--------------+                                +----^------+---+
                                                     |      |
                                                     |      |
                                   3. validates if   |      | 2. if correct, credentials
                                   256 bit string is |      | forwarded as 256 bit string.
                                   valid.            |      |
                                                     |      |
                                                |               |
                                                |  resource     |
                                                |  owner        |
                                                |               |
                                                |               |
                                                |               |
                                                |               |


I hope my use case will clarify a bit more. I can only make minor changes to the resource owner (for a variety of non-tech related issues) and the type of authentication I want (two-factor) is not a minor change. So I want the authentication server to redirect (after a successful authorization) the client to the resource owner ([512 bit string] POSTed to https://www.resource-owner.com/)/. Now the resource owner asks the authorization server: is this token valid and for which user? It will return the user id is valid.
- The token expires after 5 seconds.
- The token is just a token, there is nothing encrypted inside of the token.

  • Are there any other attributes that are passed alongside the token? What is the parameter called that contains the authenticated hash? Do you know what ports are involved? Any additional information you can provide will assist in identification of the technology.
    – user144242
    Nov 15, 2017 at 20:00
  • Are you looking for the name of a general strategy, or a specific technology? Anyway, authentication would be done by an authentication server; authorization would be done by the resource owner.
    – Spencer
    Nov 15, 2017 at 23:49
  • The name of a general strategy, I've also updated the question a bit, thanks in advance for helping! Nov 16, 2017 at 17:49

1 Answer 1


It sounds similar to OAUTH but the token usually contains basic attributes, including the user identity. You need to make sure that whatever the token contains cannot be modified, this can be done through validating a signature or using an HMAC.

I wouldn’t recommend reinventing the wheel here, just implement OAUTH.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .