I have a REST web service which already implements oauth authentication mechanism via browser.

I would to expose my API to a number of mobile clients programmed by third parties. In this scenario 4 actors are involved:

  1. My Web application A
  2. The authentication Provider P (e.g Facebook/Google/Twitter/etc)
  3. The mobile application client C (made by a third party developer X)
  4. The End User U

I read a lot about two legged and three legged authentication with Oauth2 but I understood that none of the two are feasible solutions.

The former because involves only C and P.

The latter because involves A, P and U (i.e. A and C are products of the same developer).

For the client authentication I actually handle the situation generating a couple of keys for the developer of the client C asking to authenticate his apps against my service A and sign each requests. My question is: Since my application is naturally registered on developers.facebook.com and my keys are stored in the web server, how can the third party developer use my API and authenticate the final user? Must he register his mobile app C on facebook and share his access token with my web app A?

  • 1
    Three-legged OAuth authentication does exactly that. In OAuth terminology C and U are treated as one "leg" although they actually have separate credentials. – paj28 Feb 10 '14 at 15:06
  • paj28, maybe you could turn this comment into an answer? – Daisetsu Feb 11 '14 at 23:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.