1

I've been writing up a guide to OAuth 2.0, OpenID Connect, and Identity Server 4 mostly for my own learning, drawing on several sources such as OAuth2 In Action, OAuth 2.0 Simplified, and CISSP: A Comprehensive Beginners Guide on the Information Systems Security, but I'm having trouble finding explicit definitions of delegation, identity delegation, and delegated authorization along with how they're different (if they are).

This wikipedia article comes the closest to what I'm looking for, but its sources seem a bit questionable to me:

https://en.wikipedia.org/wiki/Delegation_(computer_security)

OAuth2 In Action and OAuth 2.0 Simplified both have explicit definitions for delegation and describe them as "letting someone who controls a resource access that resource on their behalf" and "allowing third-party applications to act on behalf of a user, without the application needing to know the identity of the user," respectively, but based on my reading these both actually describe delegated authorization or delegation of authority.

Would anyone care to take a crack at defining these or point me to something I could read to help me clear these concepts up in my head?

0

I am quoting Mastering OAuth 2.0 from Charles Bihis (2015).

Delegated Authority

[...] It refers to the ability for a service or application to gain access to a user's resources on their behalf. [...]

Federated Identity

[...] It refers to the concept that allows one service provider to allow authentication of a user using their identity with another service provider. [...]

And then another quote from the book.

Both of the scenarios mentioned [...] are actually really the same scenario. In both, the user is accessing a protected resource on behalf of another party. [...]

When talking about Delegated Authority the protected resource can be e.g. a user's Facebook photo, while when talking about Federated Identity the protected resource is the user's account information.

Here is another (slightly modified) definition for delegated authority provided by IETF.

The concept of a delegated authority allows the owner of a set of resources to delegate access to some of those resources to a designated client application, without enabling the client application to impersonate the user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.