Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm under the impression that OAuth is for authentication between three parties. Does it make sense to implement OAuth in a context where there is just a client and server.

We have a server, and a client (HTML/javascript). Currently we authenticate via the normal "post credentials to server, get a cookie, use cookie to authenticate all subsequent requests" method. Will implementing OAuth be a benefit in this situation?

share|improve this question
    
I'd go with OpenID under these circumstances. –  Gary Rowe Jan 30 '13 at 17:03
    
@GaryRowe: OpenID is simpler, but the basic structure that one service uses identity proven by another service remains. –  Jan Hudec May 28 at 11:42
add comment

2 Answers

Oauth supports different Grant Types for the differing communications you're asking about.

Here is an example in a PHP library , of a different grant type or two:

Client Credentials Grant Type Trusted Clients and UnTrusted Clients

The Client Credentials grant type is used when the client is requesting access to protected resources under its control (i.e. there is no third party).

# using HTTP Basic Authentication
$ curl -u TestClient:TestSecret https://api.mysite.com/token -d 'grant_type=client_credentials'

# using POST Body
$ curl https://api.mysite.com/token -d 'grant_type=client_credentials&client_id=TestClient&client_secret=TestSecret'

You'd get back an access token (like your cookie) and use that on all subsequent calls.

Implicit Grant Type

The Implicit grant type is similar to the Authorization Code grant type in that it is used to request access to protected resources on behalf of another user (i.e. a 3rd party). It is optimized for public clients, such as those implemented in javascript or on mobile devices, where client credentials cannot be stored.

https://api.mysite.com/authorize?response_type=token&client_id=TestClient&redirect_uri=https://myredirecturi.com/cb

Source : http://bshaffer.github.io/oauth2-server-php-docs/grant-types/client-credentials/

share|improve this answer
add comment

I suspect you don't need OAuth.

OAuth is able to "hide" a password from a server. In simple terms, OAuth swaps the users password for a "Token". There are 2 "servers". The 1st server swaps the password for the token, the 2nd server never knows the password. The 2nd server always connects to the 1st server using the "Token".

So if you want people to be able to login to your system using a facebook password, then you would use OAuth and your server would never know the users facebook password, just the token.

OAuth is used by two servers, and a possible client(user), but the client is optional.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.