OAuth 2.0 for developers – the technology you need but never really learned
0 likes710 views
The document discusses OAuth 2.0 as a protocol for allowing applications to access user data without sharing credentials. It outlines the workflow for users, administrators, and developers, emphasizing the importance of authorization without exposing sensitive information. Additionally, it includes examples of command line tools and URLs used in the implementation of OAuth 2.0 for application registration and token management.
![OAuth for administrators
execfile(”oauthAdmin.py”)
OAuthApplicationRegistrationService.addApplication(
”myapp1”, ”My App1", "https://www.renovations.com/oauth/
redirect")
OAuthApplicationRegistrationService.browseApplications()
[{display_name=My App1, client_id=myapp1,
client_secret=xxxxxxxxxxxxxxxxxxxxxxxxxx, redirect_uri=
https://www.renovations.com/oauth/redirect}]
OAuthApplicationRegistrationService.deleteApplication(”myapp
1”)
The application with the id myapp1 was deleted successfully.
https://www-01.ibm.com/support/knowledgecenter/SSYGQH_5.0.0/
admin/admin/r_admin_common_oauth_manage_list.dita](https://image.slidesharecdn.com/0f3icr6ktlesk4cetq1h-signature-aada1dd7d0f8020da2858cae41b767744aa0a4c0ee623eeef3270ee59b23e928-poli-151110091722-lva1-app6891/85/OAuth-2-0-for-developers-the-technology-you-need-but-never-really-learned-35-320.jpg)
OAuth 2.0 for developers – the technology you need but never really learned
- 1. OAuth 2.0 for developers - the technology you need but never really learned Mikkel Flindt Heisterberg OnTime® by IntraVision
- 3. Agenda • The problem we are trying to solve • Demo (OAuth for users i.e. almost real people) • The flow… • OAuth for administrators • OAuth for developers i.e. real people • Q&A Mikkel Flindt Heisterberg TwiQer: @lekkim E-mail: [email protected] hQp://lekkimworld.com hQp://slideshare.net/lekkim
- 4. The problem we are trying to solve
- 5. The problem we are trying to solve Give me your Social site username and password and we can play…
- 6. The problem we are trying to solve Doesn’t really trust that shiny new site – or IBM Connec>ons for that ma@er… Give me your Social site username and password and we can play…
- 7. The problem we are trying to solve I support OAuth 2.0 and don’t want your creden>als – just authorize me to work on your behalf…
- 8. The problem we are trying to solve 1 2 3
- 9. it’s about le,ng a service access user data without knowing the users creden7als... - or without the user being there...
- 10. demo
- 11. Demo safety
- 23. 1) User accesses site and logs in CLIENT PROVIDER USER 1
- 24. 2) The site checks to see if it has Tokens for the Provider in its credenGal store CLIENT PROVIDER USER 2
- 25. 3) The site sends a redirecGon to the client telling it to go authorize it at the Provider. The URL contains the Client redirect_uri and client_id CLIENT PROVIDER USER 3
- 26. 4) The user use the redirect URL and go the provider and log ins if not already logged in. Then he authorizes the Client CLIENT PROVIDER USER 4
- 27. 5) The Provider returns a Gme limited authorizaGon_code in a redirecGon URL to the user CLIENT PROVIDER USER 5
- 28. 6) The User sends the authorizaGon_code to the Client CLIENT PROVIDER USER 6
- 29. 7) Out-of-band the Client sends the authorizaGon_code, it’s client_id, redirect_uri and secret to the Provider CLIENT PROVIDER USER 7
- 30. 8) The Provider exchange the authorizaGon_code for a short lived access_token (yellow) and a longer lived refresh_token (blue) CLIENT PROVIDER USER 8
- 31. 9) When the User now access the site it can use the access_token to work as the User. Even if the user is not there i.e. not logged into the site… CLIENT PROVIDER USER 9
- 35. OAuth for administrators execfile(”oauthAdmin.py”) OAuthApplicationRegistrationService.addApplication( ”myapp1”, ”My App1", "https://www.renovations.com/oauth/ redirect") OAuthApplicationRegistrationService.browseApplications() [{display_name=My App1, client_id=myapp1, client_secret=xxxxxxxxxxxxxxxxxxxxxxxxxx, redirect_uri= https://www.renovations.com/oauth/redirect}] OAuthApplicationRegistrationService.deleteApplication(”myapp 1”) The application with the id myapp1 was deleted successfully. https://www-01.ibm.com/support/knowledgecenter/SSYGQH_5.0.0/ admin/admin/r_admin_common_oauth_manage_list.dita
- 36. I’M A DEVELOPER
- 42. OAuth for developers Client POST’s the authorizaZon code, client ID, redirecZon URI and client secret to the Provider out-of-band (server to server, not through User) Syntax POST /oauth2/endpoint/connectionsProvider/token HTTP/1.0 Host: <hostname> Content-Length: <length> Connection: Close client_secret=<client_secret>&client_id=<client_id>&grant_type=authorization _code&code=<auth_code>&callback_uri=<callback_uri> Example POST /oauth2/endpoint/connectionsProvider/token HTTP/1.0 Host: social.example.com Content-Length: 161 Connection: Close client_secret=my_secret_string&client_id=myapp1 &grant_type=authorization_code&code=user_specific_auth_code &callback_uri=https://myapp.shinysite.com/oauth20_cb
- 43. OAuth for developers Provider responds with (JSON) response with access token, refresh token and expiry info. It would be wise that the client saves the tokens… Example { "access_token”: "d86o7UP0gj2c...GVzTPADsFv7”, "token_type": "Bearer", "expires_in": 43200, "scope": "", "refresh_token": "EWcVt5uaaXC9Pc...pTTgvrLRrs56gR” }
- 44. OAuth for developers To make requests on behalf of the User the Client needs to set the access token in a header Example GET /connections/opensocial/oauth/rest /activitystreams/@me/@all/@all HTTP/1.0 Host: social.example.com Authorization: Bearer d86o7UP0gj2c...GVzTPADsFv7 Connection: Close If the Client use an access token and receive a 401 back from the Provider it should aQempt the refresh token to – well – refresh the access token. If that also fails the User probably revoked access...