1. ADUG 21-Oct 2013 Grahame Grieve

6. The OAuth Protocol
Allows an application to login users using someone else’s login details (without seeing their password)
Protocol is web based
Web sites
Mobile Applications
Desktop Applications

8. What are User Resources?
User Information
Address
Real world Identifying Information (name, etc)
Google/Facebook friend list
User specific services
Post to facebook wall
Storage (e.g. DropBox)
Health Care information

9. OAuth Parties User Service Provider Service Consumer
User who wants to achieve something
Service Provider
Can authenticate the user (password etc)
Has things the user owns
Service Consumer
Needs to use User’s resources (e.g. for the user)
Trusted by the service provider and the user

11. OAuth Parties User Service Provider Service Consumer
User who wants to achieve something
Service Provider
Can authenticate the user (password etc)
Has things the user owns
Service Consumer
Needs to use User’s resources (e.g. for the user)
Trusted by the service provider and the user

12. Authorization vs Authentication
Service Consumer doesn’t know who the user is
Just knows that the Service Provider authorises the consumer to do things on behalf of anonymous user
Which may include identifying information … if service provider authenticated the user

13. OAuth Example Desktop Application
Allows user to load/save application configuration to their Dropbox store

25. OAuth Pro’s & Cons Delegate User Authentication problems
Well understood protocol
Amazing services on offer
Relatively Simple API
Each implementation differs – it’s a technique
Documentation confusing and byzantine
Errors obtuse and misleading
Not a full solution yet