A brief overview of the popular 3rd-party authentication and authorization methods and implementations used in web apps.

3. Facebook

5. Single identify throughout the Internet

6. Returns: identifier (and optional data)

8. Consumer “discovers” based on the URL

9. Redirects to provider

10. User authenticates with provider

11. Redirects to consumer Lots of hashy stuff going on here. Discovery varies V1 to V2.

13. OpenID V2 + AX

14. Single discovery URL for everybody

16. Returns: identifier and access token

18. Redirects User to Service

19. User authenticates and authorizes

20. Redirects to Site

21. Site gets access token from Service All implementations are service-specific. Hashy stuff varies V1 to V2.

23. Has both authentication and authorization endpoints

24. Access levels: read, read/write, read/write/private.

26. Very fine-grained permissions