The tag has no wiki summary.

learn more… | top users | synonyms

3
votes
2answers
60 views
+300

Auth options for distributed systems

I am in the process of designing 3 components that will work in symphony with one another: A RESTful web service which requires BasicAuth over HTTPS on all calls, and which is what actually does all ...
0
votes
1answer
31 views

OAuth/OAuth2 RFC question

This question is about a line from the OAuth2 rfc - https://tools.ietf.org/html/rfc6749 In Section 2.3, there is this line The client MUST NOT use more than one authentication method in each ...
0
votes
0answers
27 views

How to use oauth2 roles and scopes to secure services

I have secured a rest api using oauth 2 security and I am not sure on how to configure security access using roles or scopes There will be 3 types of clients: public mobile app client used by ...
1
vote
1answer
184 views

What OpenID Connect flow is right for me?

Here's the deal. I have a .NET MVC5 web application that I'm moving up to the OpenID Connect standard. I also would like to be able to access controller methods from a mobile app (much like an API) ...
1
vote
1answer
62 views

oauth 2 authenticate with other authorization server

Let's assume i have a mobile app backed up by a Server. the server is both an Authorization and Resource Server. Now i want to enable users to register / login to the app using Facebook API. After ...
0
votes
2answers
85 views

Secure Rest api from authenticated user

Let's say that my Rest api is secured using OAuth 2. Let's say my client is a mobile App. Let's say that i have an Api call: @Post /increasePoints host:https://www.example.com/increasePoints ...
2
votes
0answers
300 views

How to bypass Oauth2 authentication when the client and resource owner is the same entity?

We are currently working on using an API provided by Mercado Libre which is a maket place for selling various goods. Their APIs use OAuth 2.0 for authentication. The problem is that OAuth 2.0 as ...
0
votes
0answers
23 views

Should I use OAUTH 'scopes' to provide access to specific resources?

I am researching & and learning about OAUTH, so please forgive me if this is a very stupid question.. It seems that scopes are typically used to define actions that I can take on behalf of a ...
2
votes
1answer
58 views

OAuth 2.0 - Should Client Identifier be unique for each user or only by client type?

Oauth 2 Specification, Section 2.2. (Client Identifier) states - The authorization server issues the registered client a client identifier -- a unique string representing the registration ...
2
votes
0answers
127 views

Oauth 2 store access token vs verifying on each call

Let's say my Server is both Authorization Server and Resource server My Client (for example mobile app) can authenticate in 2 matters: via Resource Owner Password Credentials Grant via ...
6
votes
3answers
687 views

OAuth alternative for a 2 party system

I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database. I do ...
0
votes
1answer
171 views

Implementing internal own authentication

Let me apologize first if this topic is too subjective, or not concrete enough. I want to implement a login api for an internal web service at my company using asp web api 2. I know how to implement ...
3
votes
0answers
325 views

OAuth shared Authorization server for multiple apps

At my shop we have a couple .NET Web APIs that use OAuth tokens for authentication. Currently, each web API is both authorization and resource server. Users authenticate to all of these APIs using ...
0
votes
0answers
106 views

What should my redirect URL be for OAuth2.0 in Azure if my application is a local windows application?

I am setting up OAuth2.0 on Azure. I am at the stage where I have been allowed access to the application and a Code has been returned in my redirect URL. My application is a local windows application. ...
1
vote
0answers
103 views

Switching between Azure Mobile Services vs my own implementation. Will UIDs change?

I'm looking at Azure Mobile Services, particularly the Authentication part (which I believe relies exclusively on OAUTH 1 or 2). I want to make sure that my application isn't tightly coupled to the ...
1
vote
0answers
129 views

How to evaluate Secure Authorization for server to client

I have a customer that wants me to build a web portal (Asp.net 4.0) that will communicate with a desktop client, tablet and/or smart phone (e.g. iOS and/or Android). I was thinking of using oAuth ...
1
vote
1answer
511 views

Using oAuth as a complement to an existing authentication system?

I am hoping this is the correct stack exchange to be asking this, here goes. I am building a new website whereby it implements its own custom login system. You simply register your username, email ...
3
votes
2answers
391 views

What's the benefit of Azure ACS if ASP.NET 4.5 includes OAuth and OpenID providers?

Azure ACS offers OAuth and OpenID providers, and now that ASP.NET 4.5 offers the same thing, without the added cost, is there any reason for a .NET developer to consider ACS? (Disclaimer, I don't ...
5
votes
1answer
2k views

OAuth2 flow - does the server validate with the Auth server?

I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something. I understand that the client authorises with the OAuth provider (google for example) and ...