I'm working on a specific security design. When reading it, it looks like some form of OATH but I'm not sure which kind.
The scheme is as follows:
- The client authenticates through a web-portal (authorization server) with username password.
- After a successful authentication, the user is forwarded to the resource-owner, the request contains a token.
- The resource-owner validates the token with the authorization server.
- The authorization server tells who the corresponding user is.
Now my question is: What is this schema called?
+--------------+ +---------------+
| | | |
| | 1. sends user & pass | authorization|
| client | +----------------------------> | server |
| | | |
| | | |
| | | |
| | | |
+--------------+ +----^------+---+
| |
| |
3. validates if | | 2. if correct, credentials
256 bit string is | | forwarded as 256 bit string.
valid. | |
| |
+----+------v---+
| |
| resource |
| owner |
| |
| |
| |
| |
+---------------+
UPDATE:
I hope my use case will clarify a bit more. I can only make minor changes to the resource owner (for a variety of non-tech related issues) and the type of authentication I want (two-factor) is not a minor change.
So I want the authentication server to redirect (after a successful authorization) the client to the resource owner ([512 bit string] POSTed to https://www.resource-owner.com/)/.
Now the resource owner asks the authorization server: is this token valid and for which user? It will return the user id is valid.
- The token expires after 5 seconds.
- The token is just a token, there is nothing encrypted inside of the token.