The tag has no wiki summary.

learn more… | top users | synonyms

5
votes
2answers
112 views

Auth options for distributed systems

I am in the process of designing 3 components that will work in symphony with one another: A RESTful web service which requires BasicAuth over HTTPS on all calls, and which is what actually does all ...
0
votes
0answers
30 views

How to use oauth2 roles and scopes to secure services

I have secured a rest api using oauth 2 security and I am not sure on how to configure security access using roles or scopes There will be 3 types of clients: public mobile app client used by ...
0
votes
1answer
36 views

OAuth/OAuth2 RFC question

This question is about a line from the OAuth2 rfc - https://tools.ietf.org/html/rfc6749 In Section 2.3, there is this line The client MUST NOT use more than one authentication method in each ...
1
vote
1answer
199 views

What OpenID Connect flow is right for me?

Here's the deal. I have a .NET MVC5 web application that I'm moving up to the OpenID Connect standard. I also would like to be able to access controller methods from a mobile app (much like an API) ...
1
vote
1answer
67 views

oauth 2 authenticate with other authorization server

Let's assume i have a mobile app backed up by a Server. the server is both an Authorization and Resource Server. Now i want to enable users to register / login to the app using Facebook API. After ...
0
votes
0answers
23 views

Should I use OAUTH 'scopes' to provide access to specific resources?

I am researching & and learning about OAUTH, so please forgive me if this is a very stupid question.. It seems that scopes are typically used to define actions that I can take on behalf of a ...
2
votes
1answer
61 views

OAuth 2.0 - Should Client Identifier be unique for each user or only by client type?

Oauth 2 Specification, Section 2.2. (Client Identifier) states - The authorization server issues the registered client a client identifier -- a unique string representing the registration ...
0
votes
2answers
86 views

Secure Rest api from authenticated user

Let's say that my Rest api is secured using OAuth 2. Let's say my client is a mobile App. Let's say that i have an Api call: @Post /increasePoints host:https://www.example.com/increasePoints ...
2
votes
0answers
133 views

Oauth 2 store access token vs verifying on each call

Let's say my Server is both Authorization Server and Resource server My Client (for example mobile app) can authenticate in 2 matters: via Resource Owner Password Credentials Grant via ...
0
votes
1answer
176 views

Implementing internal own authentication

Let me apologize first if this topic is too subjective, or not concrete enough. I want to implement a login api for an internal web service at my company using asp web api 2. I know how to implement ...
3
votes
0answers
332 views

OAuth shared Authorization server for multiple apps

At my shop we have a couple .NET Web APIs that use OAuth tokens for authentication. Currently, each web API is both authorization and resource server. Users authenticate to all of these APIs using ...
0
votes
0answers
108 views

What should my redirect URL be for OAuth2.0 in Azure if my application is a local windows application?

I am setting up OAuth2.0 on Azure. I am at the stage where I have been allowed access to the application and a Code has been returned in my redirect URL. My application is a local windows application. ...
6
votes
3answers
694 views

OAuth alternative for a 2 party system

I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database. I do ...
2
votes
0answers
301 views

How to bypass Oauth2 authentication when the client and resource owner is the same entity?

We are currently working on using an API provided by Mercado Libre which is a maket place for selling various goods. Their APIs use OAuth 2.0 for authentication. The problem is that OAuth 2.0 as ...
1
vote
0answers
103 views

Switching between Azure Mobile Services vs my own implementation. Will UIDs change?

I'm looking at Azure Mobile Services, particularly the Authentication part (which I believe relies exclusively on OAUTH 1 or 2). I want to make sure that my application isn't tightly coupled to the ...
1
vote
0answers
130 views

How to evaluate Secure Authorization for server to client

I have a customer that wants me to build a web portal (Asp.net 4.0) that will communicate with a desktop client, tablet and/or smart phone (e.g. iOS and/or Android). I was thinking of using oAuth ...
1
vote
1answer
515 views

Using oAuth as a complement to an existing authentication system?

I am hoping this is the correct stack exchange to be asking this, here goes. I am building a new website whereby it implements its own custom login system. You simply register your username, email ...
3
votes
2answers
392 views

What's the benefit of Azure ACS if ASP.NET 4.5 includes OAuth and OpenID providers?

Azure ACS offers OAuth and OpenID providers, and now that ASP.NET 4.5 offers the same thing, without the added cost, is there any reason for a .NET developer to consider ACS? (Disclaimer, I don't ...
5
votes
1answer
2k views

OAuth2 flow - does the server validate with the Auth server?

I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something. I understand that the client authorises with the OAuth provider (google for example) and ...