OAuth2 how does it work (Android client)

Question

I have read a lot about Oauth2 but still cannot understand, how does it work. I will explain how do I understand this protocol.

There are some main characters in Oauth protocol interaction.
User, application, resource provider and authorization server.
How do I understand main flow.
I am creating mobile client, so I will use it as an example.

Firstly user installs app, than first time user run this app to access secured resources user have to enter password and login not directly credentials for resource server, but for authorization server. For example, I have online store app , user allowed to login via facebook account, so when user need to access resources from my site first step will authorize with facebook account. You enter login and password and if credentials are correct facebook server gives you or your app access token.

After you got the access token, you store it on device in secure place or in local database (for android it is SQLite).
When you successfully signed in, Oauth server redirects you to the resource provider server (my online store) wit token, resource server saves this token into the database along with user id/login name. So now your resource server knows that user with such id can access secured resources with this token.

On the client side (android app) you now have this token, it has expire date. When you need to access secure resources you pass this token in your POST/PUT or any request over HTTPS protocol, because if another person get this token, it can be used to access private, and make changes.

For example you need to place an order, from mobile client you make REST request with attached token, resource server checks this token and if it is the same as in the database you are allowed to access/change secured resources.

Am I right, or I don't understand Oauth protocol correctly ?

Now my questions

1. If I have native client, and I don't have ability for user to login with social network accounts and other Oauth2 servers in the network, only allow to login as on the web page ? With password and login. In this case Oauth2 is not applicable in this case ? If yes, next question.

2. What should I use instead ? I need to send credentials only once to my resource server, it will check them, generate token if everything is ok, put token into database, and return success response to the app. For instance using POST method over https connection to send password and login for the first time. Now resource server issues me the same token as in Oauth flow ?

3. How can I secure issued token ? Make user reenter login and password after some time ?

Please help me to get this. I would be grateful for any help.

Answer 1

To your questions:

1. [...] I don't have ability for user to login with social network accounts and other Oauth2 servers in the network [...].

You will need your own OAuth authorisation server, that will manage your resource server. The OAuth server from Google, Facebook, Twitter, etc., will not help because, as far as I know, can only grant access to their own resources such as email, photos, posts, etc.

An example would be:

• You need a picture for your service.
• You want the one an other site is using.
• You get authorised by the owner of the picture (typical the user).
• With the token you now can access the picture.

I think you understand the protocol flow, but probably mix up Authentication(verify ones identity) and Authorisation(grant access to resources).

OAuth v2.0 is an authorisation protocol, it will manage the access to resources. To make it possible for other services (this could be your app) to access your resource server data.