The tag has no usage guidance.

learn more… | top users | synonyms

4
votes
0answers
29 views

Is this a correct JWT authentication implementation?

I've created a Flask RESTful API which requires an email / password and Facebook login flow. This will probably need to be extended in the future to support more social logins. I've chosen to ...
3
votes
0answers
67 views

Is OAuth 2.0 ok for building a container of applications?

I need to create a container app which contains several apps (imagine something like iCloud): once I've been logged in, I can see all the apps by means of icons, click on them and use them (a new ...
2
votes
2answers
37 views

Proper OAuth2 Grant

I'm looking to build a mobile application (iOS / Android) that digests information from a secured API. The API will require OAuth2 authentication to be able to digest any resources. The service I'm ...
2
votes
1answer
79 views

Social auth from mobile app connected to API server

I have a Node.js server using PassportJS that uses social login via Google, Facebook, and Twitter. The Node.js server hosts an API that uses the PassportJS middleware to authenticate routes and ...
0
votes
0answers
67 views

Understanding SSO flows

I m actually studying SSO using OAuth2 and I m having some questions working with real architecture. I understand the way how we connect to a tier server, getting an access token and making requests ...
0
votes
0answers
30 views

Modeling token generation on OAuth2 for two different users

I have an OAuth2 implementation that works with the authorization_code flow. As per an implicit relationship, one kind of user (Alice) is able to retrieve tokens for the other (Bob). On the RFC it ...
2
votes
0answers
35 views

Architecting an account system for oauth that bridges a new and legacy system

So this question is specific to implementing auth in our system but I'm looking for high-level (just the architecture) solution or advice on which direction to head towards. Overview (TL;DR) Our ...
0
votes
0answers
45 views

OAuthv2 for the JVM

It looks like OAuthv2 identifies several different categories of actors: Client applications, desiring READ and/or WRITE access on remote resource servers Auth servers, used for ...
1
vote
1answer
72 views

OAuthv2 access tokens and resource servers

In the OAuthv2 authorization grant, a “client app” authenticates itself against an “auth server”, and receives an “access token” for accessing resources living on a “resource server”. My concerns: ...
2
votes
1answer
111 views

OAuthv2 for distributed applications

Please note: Months ago I asked this question that received a truly amazing answer and introduction to OAuthv2. I’m now knee deep in the implementation of such a system and have similar (but notably ...
5
votes
1answer
42 views

OAuthv2 authorization grants

I just read this excellent tutorial on OAuthv2 but am still missing some important concepts regarding authorization grants. I'm fundamentally not understanding the necessity for the two ...
0
votes
0answers
115 views

.Net MVC 5.0 Website using Asp.Net Identity

I have a newly configured website using web api 2.2 and the latest version of asp.net Identity. I have the authorization working great for users that login and navigate the site. I'm trying to ...
4
votes
0answers
364 views

Multiple Oauth2 access tokens

I have an API that uses oAuth2 and my own mobile apps that use this API as their backend. Since users can be logged on via multiple devices (i.e iphone, ipad, android tablet or android phone) at the ...
2
votes
1answer
176 views

Is it safe to include connection data in token?

When generating a ClaimIdentity for use by oAuth in generating a token, is it safe to include database information as a claim? My application uses a different database depending on the specific ...
5
votes
2answers
406 views

Auth options for distributed systems

I am in the process of designing 3 components that will work in symphony with one another: A RESTful web service which requires BasicAuth over HTTPS on all calls, and which is what actually does all ...
1
vote
0answers
222 views

How to use oauth2 roles and scopes to secure services

I have secured a rest api using oauth 2 security and I am not sure on how to configure security access using roles or scopes There will be 3 types of clients: public mobile app client used by ...
1
vote
1answer
53 views

OAuth/OAuth2 RFC question

This question is about a line from the OAuth2 rfc - https://tools.ietf.org/html/rfc6749 In Section 2.3, there is this line The client MUST NOT use more than one authentication method in each ...
2
votes
1answer
982 views

What OpenID Connect flow is right for me?

Here's the deal. I have a .NET MVC5 web application that I'm moving up to the OpenID Connect standard. I also would like to be able to access controller methods from a mobile app (much like an API) ...
1
vote
1answer
202 views

oauth 2 authenticate with other authorization server

Let's assume i have a mobile app backed up by a Server. the server is both an Authorization and Resource Server. Now i want to enable users to register / login to the app using Facebook API. After ...
2
votes
1answer
129 views

OAuth 2.0 - Should Client Identifier be unique for each user or only by client type?

Oauth 2 Specification, Section 2.2. (Client Identifier) states - The authorization server issues the registered client a client identifier -- a unique string representing the registration ...
1
vote
2answers
129 views

Secure Rest api from authenticated user

Let's say that my Rest api is secured using OAuth 2. Let's say my client is a mobile App. Let's say that i have an Api call: @Post /increasePoints host:https://www.example.com/increasePoints ...
3
votes
0answers
271 views

Oauth 2 store access token vs verifying on each call

Let's say my Server is both Authorization Server and Resource server My Client (for example mobile app) can authenticate in 2 matters: via Resource Owner Password Credentials Grant via ...
1
vote
1answer
291 views

Implementing internal own authentication

Let me apologize first if this topic is too subjective, or not concrete enough. I want to implement a login api for an internal web service at my company using asp web api 2. I know how to implement ...
7
votes
1answer
754 views

OAuth shared Authorization server for multiple apps

At my shop we have a couple .NET Web APIs that use OAuth tokens for authentication. Currently, each web API is both authorization and resource server. Users authenticate to all of these APIs using ...
6
votes
3answers
861 views

OAuth alternative for a 2 party system

I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database. I do ...
3
votes
1answer
430 views

How to bypass Oauth2 authentication when the client and resource owner is the same entity?

We are currently working on using an API provided by Mercado Libre which is a maket place for selling various goods. Their APIs use OAuth 2.0 for authentication. The problem is that OAuth 2.0 as ...
2
votes
0answers
109 views

Switching between Azure Mobile Services vs my own implementation. Will UIDs change?

I'm looking at Azure Mobile Services, particularly the Authentication part (which I believe relies exclusively on OAUTH 1 or 2). I want to make sure that my application isn't tightly coupled to the ...
1
vote
0answers
132 views

How to evaluate Secure Authorization for server to client

I have a customer that wants me to build a web portal (Asp.net 4.0) that will communicate with a desktop client, tablet and/or smart phone (e.g. iOS and/or Android). I was thinking of using oAuth ...
1
vote
1answer
611 views

Using oAuth as a complement to an existing authentication system?

I am hoping this is the correct stack exchange to be asking this, here goes. I am building a new website whereby it implements its own custom login system. You simply register your username, email ...
2
votes
1answer
428 views

What's the benefit of Azure ACS if ASP.NET 4.5 includes OAuth and OpenID providers? [closed]

Azure ACS offers OAuth and OpenID providers, and now that ASP.NET 4.5 offers the same thing, without the added cost, is there any reason for a .NET developer to consider ACS? (Disclaimer, I don't ...
7
votes
2answers
4k views

OAuth2 flow - does the server validate with the Auth server?

I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something. I understand that the client authorises with the OAuth provider (google for example) and ...