The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
11 views

Should I use OAUTH 'scopes' to provide access to specific resources?

I am researching & and learning about OAUTH, so please forgive me if this is a very stupid question.. It seems that scopes are typically used to define actions that I can take on behalf of a ...
2
votes
1answer
31 views

OAuth 2.0 - Should Client Identifier be unique for each user or only by client type?

Oauth 2 Specification, Section 2.2. (Client Identifier) states - The authorization server issues the registered client a client identifier -- a unique string representing the registration ...
0
votes
1answer
49 views

Secure Rest api from authenticated user

Let's say that my Rest api is secured using OAuth 2. Let's say my client is a mobile App. Let's say that i have an Api call: @Post /increasePoints host:https://www.example.com/increasePoints ...
1
vote
0answers
50 views

Oauth 2 store access token vs verifying on each call

Let's say my Server is both Authorization Server and Resource server My Client (for example mobile app) can authenticate in 2 matters: via Resource Owner Password Credentials Grant via ...
0
votes
1answer
135 views

Implementing internal own authentication

Let me apologize first if this topic is too subjective, or not concrete enough. I want to implement a login api for an internal web service at my company using asp web api 2. I know how to implement ...
3
votes
0answers
205 views

OAuth shared Authorization server for multiple apps

At my shop we have a couple .NET Web APIs that use OAuth tokens for authentication. Currently, each web API is both authorization and resource server. Users authenticate to all of these APIs using ...
0
votes
0answers
79 views

What should my redirect URL be for OAuth2.0 in Azure if my application is a local windows application?

I am setting up OAuth2.0 on Azure. I am at the stage where I have been allowed access to the application and a Code has been returned in my redirect URL. My application is a local windows application. ...
0
votes
0answers
19 views

Where you are both the Authorization Server and Resource Server does it make sense to use OAUTH2 for security?

I'm curious if there are any use cases where it makes sense to use OAUTH2 where you are both the protected resource and the authorization server. In this case you have the passwords already for ...
0
votes
0answers
74 views

Communication between resource and authorization server/identity manager?

Short Doing the design / for an api we're building we noticed there is little to nothing to be found on how your resource server can validate a token given by a client with the ...
6
votes
3answers
631 views

OAuth alternative for a 2 party system

I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database. I do ...
2
votes
0answers
240 views

How to bypass Oauth2 authentication when the client and resource owner is the same entity?

We are currently working on using an API provided by Mercado Libre which is a maket place for selling various goods. Their APIs use OAuth 2.0 for authentication. The problem is that OAuth 2.0 as ...
1
vote
0answers
88 views

Switching between Azure Mobile Services vs my own implementation. Will UIDs change?

I'm looking at Azure Mobile Services, particularly the Authentication part (which I believe relies exclusively on OAUTH 1 or 2). I want to make sure that my application isn't tightly coupled to the ...
1
vote
0answers
122 views

How to evaluate Secure Authorization for server to client

I have a customer that wants me to build a web portal (Asp.net 4.0) that will communicate with a desktop client, tablet and/or smart phone (e.g. iOS and/or Android). I was thinking of using oAuth ...
1
vote
1answer
454 views

Using oAuth as a complement to an existing authentication system?

I am hoping this is the correct stack exchange to be asking this, here goes. I am building a new website whereby it implements its own custom login system. You simply register your username, email ...
3
votes
2answers
370 views

What's the benefit of Azure ACS if ASP.NET 4.5 includes OAuth and OpenID providers?

Azure ACS offers OAuth and OpenID providers, and now that ASP.NET 4.5 offers the same thing, without the added cost, is there any reason for a .NET developer to consider ACS? (Disclaimer, I don't ...
4
votes
1answer
2k views

OAuth2 flow - does the server validate with the Auth server?

I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something. I understand that the client authorises with the OAuth provider (google for example) and ...