Scenario: I need to build a new API for a third party company who are building a tool to capture information of new users wishing to create accounts on our enterprise platform.
My preferred solution:
- API to be secured with OAuth2.0 client_credentials flow
- (if required) An added layer of security with Mutual TLS to validate the source of requests at a network level
However a colleague has suggested that the solution should be oAuth1.0 (unsure of which flow he has in mind)
His reasoning is :
OAuth1 is usually constrained for server-to-server authentication whereas OAuth2 can be used for secure client-to-server authentication. However OAuth2 can be used for server-to-server auth using a service account. The key issue here then is that we have not established authentication credentials of the end-user at the point of invoking the resource API, so the third party server will be authenticating against the API using a service account, not end-user credentials
I am at a loss here, because I do not see OAuth1 as allowing us to establish authentication of the end-user in anyway.
What am I missing?
- It is my understanding that OAuth1 has largely been discontinued - largely due to the complexity it brings with cryptographic requirements with request signing.
If this is in fact required I see it best solved with a form of federated authorization model - Open Id with Signed JWTs - Sign in With Google / Facebook etc...
Where a token will have claims associated against them and be signed by a trusted resource.
(A total newbie with security best practice - so appreciate any guidance / help)