My talk for the Dutch PHP Conference, explaining the point of oauth, the mechanics of oauth2 and the various flows, and a spot of oauth1 for completeness

1. OAuth: A Question of Trust

2. About Me
• Lorna Jane Mitchell
• Twitter: @lornajane
• Web: http://lornajane.net
2

3. If OAuth is the answer, what was the
question?

4. OAuth
username: lornajane
password: qwerty
4

5. OAuth
Hi, I’m lornajane
5

6. Two Kinds of OAuth
• OAuth 1
• in use on many systems
• many steps: ’the oauth dance’
• encryption overhead (so use a lib)
• OAuth 2
• requires SSL
• fewer steps
• recognises trust
• recommended for new systems
6

7. OAuth 2: Performance over Paranoia

8. OAuth2 Relationships
8

9. OAuth2 Relationships
9

10. Before We Begin
Register for an API key and capture:
• application name
• callback URL(s) to use
• description
e.g. http://joind.in/user/apikey
10

11. OAuth2 Endpoints
Application Website API Client
api key registration auth endpoint callback URL
user grant/revoke access resource endpoint
resources
11

12. Establishing Trust
We need an authorisation grant for the assistant to be able to access
user data
12

13. Authorisation Grants

14. Authorisation Grant: Many Choices
How we authorise a third party:
• authorisation code
• implicit
• resource owner credentials
• client credentials
• ... potentially further extensions
14

15. Authorisation Code
Use for: server-side apps
Flow: we send user to application to grant access, recieve a code in
return. Then exchange code for access token
Features: user never sees access token
15

16. Authorisation Code Process
client_id
redirect_url
type
scope
state
16

17. Authorisation Code Process
User must be able to visit the site and revoke later
17

18. Authorisation Code Process
code
code
state
18

19. Authorisation Code Process
client_key
client_secret
code
code
access token
access_token
19

20. Implicit Grant
Use for: client-side apps
Flow: we send user to application to grant access, recieve an access
token in return
Features: super-simple
20

21. Implicit Process
client_id
redirect_url
type
scope
state
21

22. Implicit Process
User must be able to visit the site and revoke later
22

23. Implicit Process
access token
access_token
state
23

24. Resource Owner Credentials
Use for: trusted consumers, such as same-provider apps or a script the
user writes themselves
Flow: user gives username and password to app, app exchanges for
access token and does not store
Features: saves sending user to the main site and back
24

25. Resource Owner Credentials Process
username, username,
password password
25

26. Resource Owner Credentials Process
access token
26

27. Client Credentials
Use for: privileged consumers
Flow: client credentials act as an authorsation grant, access token is
returned
Features: ideal for applications with more than per-user-data access
rights
27

28. Client Credentials Process
hai
access token
28

29. How to Choose Grant Type
What will be consuming this data?
It isn’t unusual for applications to support some or all of these grant types
29

30. You have an access token, now what?

31. Using Access Tokens
With the access token, include it in an Authorization header:
Authorization: OAuth db141c50adb74b22
31

32. Using Access Tokens
With the access token, include it in an Authorization header:
Authorization: OAuth db141c50adb74b22
Everything you already knew about web APIs now applies as normal
31

33. Refresh Tokens
Some applications will give you two tokens
• access token (shorter expiry)
• refresh token (longer expiry)
The refresh token is an authorisation grant in its own right, to be used
when the access token has expired
32

34. What about access control?

35. Scope
Consumers will request a given set of permissions, usually called scope
Users usually only get to accept, or not
34

36. HTTPS (a vital OAuth2 ingredient)

37. HTTPS
HTTPS is HTTP over SSL/TLS (Secure Socket Layer/Transport Layer
Security)
Basically, we encrypt the pipe!
36

38. OAuth 1

39. About OAuth 1
In a nutshell:
• Had its own encryption: needed a library/extension
• Involved many steps, therefore many request/response roundtrips
• leading to the phrase ’oauth dance’
• Solved exactly the same problem
• Had a single oauth endpoint
38

40. OAuth 1 Process
• Step 0: Register as a consumer
• Step 1: Get a request token
• Step 2: Send the user to authenticate
• Step 3: Swap their verification for an access token
• Step 4: Consume data
39

41. OAuth Today

42. OAuth Today
• New project? Use OAuth 2
• OAuth 1 is complicated and needs PECL extension
• OAuth 2 requires SSL, and decision-making
41

43. Resources and Further Reading
• OAuth2 Spec:
http://tools.ietf.org/html/draft-ietf-oauth-v2
• Great introductory article:
http://hueniverse.com/2010/05/introducing-oauth-2-0/
• Images from http://thenounproject.org
42

44. Thanks!

45. Thanks
https://joind.in/6232
@lornajane
http://lornajane.net
44