I've been writing up a guide to OAuth 2.0, OpenID Connect, and Identity Server 4 mostly for my own learning, drawing on several sources such as OAuth2 In Action, OAuth 2.0 Simplified, and CISSP: A Comprehensive Beginners Guide on the Information Systems Security, but I'm having trouble finding explicit definitions of delegation, identity delegation, and delegated authorization along with how they're different (if they are).

This wikipedia article comes the closest to what I'm looking for, but its sources seem a bit questionable to me:


OAuth2 In Action and OAuth 2.0 Simplified both have explicit definitions for delegation and describe them as "letting someone who controls a resource access that resource on their behalf" and "allowing third-party applications to act on behalf of a user, without the application needing to know the identity of the user," respectively, but based on my reading these both actually describe delegated authorization or delegation of authority.

Would anyone care to take a crack at defining these or point me to something I could read to help me clear these concepts up in my head?

2 Answers 2


I am quoting Mastering OAuth 2.0 from Charles Bihis (2015).

Delegated Authority

[...] It refers to the ability for a service or application to gain access to a user's resources on their behalf. [...]

Federated Identity

[...] It refers to the concept that allows one service provider to allow authentication of a user using their identity with another service provider. [...]

And then another quote from the book.

Both of the scenarios mentioned [...] are actually really the same scenario. In both, the user is accessing a protected resource on behalf of another party. [...]

When talking about Delegated Authority the protected resource can be e.g. a user's Facebook photo, while when talking about Federated Identity the protected resource is the user's account information.

Here is another (slightly modified) definition for delegated authority provided by IETF.

The concept of a delegated authority allows the owner of a set of resources to delegate access to some of those resources to a designated client application, without enabling the client application to impersonate the user.


It depends :)

Merriam Webster defines 'delegation' as:

"the act of empowering to act for another"

This definition also works fine in a security context:

  • Identity delegation empowers you to assume someone's identity.
  • Delegated authorization empowers you to assume someone's authorization (keeping your own identity).

The difference becomes clear when considering log files. Consider the example that the wiki page you link to provides for delegation of identity: sudo allows you to assume a users identity, even in how your actions are logged in the log files.

Of course, such identity delegation can just as well be considered impersonation, which is typically a negative design goal.

Therefore, delegation is typically about delegation of authorization. For instance, in Oauth2, a typical situation may be when an API1 interacts with API2 on a user's behalf. It is then often preferable to perform a token exchange, so that API1 can assume the authorization of the user, but API2 still knows API1 is acting on behalf of a certain user.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .