Giving another application limited access
Sometimes you want one application to work with your data in another without handing over your password. OAuth lets you give it limited access of its own instead.
The participants
OAuth gives each part of this arrangement a name:
- Resource owner: Ava, who can authorize access to her photos.
- Client: the printing application requesting access.
- Authorization server: the service that handles authorization and issues tokens under its policy.
- Resource server: the part of the photo service that holds the photos and checks each request for them.
The word client can be confusing. It means the application asking for access, here the printer, even if its code runs on a server. The authorization server and the photo APIAn application programming interface: a defined way for software to interact with a service. A web API offers endpoints where other programs send HTTP requests. are often run by the same company, but they do different jobs: one hands out access, the other checks it.
Ava
- Its job
- Can authorize access to her photos
- Holds
- Her password
Printing application
- Its job
- Requesting access
- Holds
- Access of its own, separate from her password
Authorization server
- Its job
- Issues tokens under its policy
- Holds
- The policy for handing out access
Photo API
- Its job
- Checks each request for them
- Holds
- The photos
The authorization server and the photo API are often run by the same company, but they do different jobs: one hands out access, the other checks it.
Following the permission
Ava chooses to connect her photos in the printer, and the printer sends her browser to the authorization server. She signs in there, on the photo service's own page, so the printer never sees her password.
The authorization server then shows Ava what the printer is asking for, such as permission to read her photos. Agreeing to that request is called consent.
Once Ava agrees, the authorization server issues the printer an access token, the kind of token from How applications communicate that lets a program call an API. The printer now holds access of its own, separate from Ava's password.
Optional detail: how the token reaches the printer
The access token usually doesn't travel through Ava's browser. The browser carries a short-lived authorization code back to the printer instead, and the printer trades that code for the access token in a direct request to the authorization server, on the back channel.
Using limited access
The printer sends the access token with each request to the photo API. The access Ava approved is described by a scope, such as photos.read for reading photos.
A scope names a kind of access, not a list of albums. photos.read doesn't let the printer read everyone's photos, so the photo API still checks each request: is this an album Ava can share?
The access token is a bearer tokenA token that works for whoever presents it: the API checks that the token is genuine and current, not who is holding it. That is why bearer tokens must be kept from being copied., so it needs protecting: anyone who copies it may be able to use it. It also expires. For a connection that lasts, the authorization server may give the printer a refresh token as well, which the printer uses only at the authorization server to get new access tokens without asking Ava again. It is never sent to the photo API.
When Ava disconnects the printer, the service has to change what it accepts, not just what her screen shows. The refresh token should stop working, and the printer's access tokens are refused once they are revoked or expire.
photos.readA scope names a kind of access, not a list of albums.
Read the selected album
- Operation within photos.read
- An album Ava can share
Read allowed within the granted access.
Read another album
- Operation within photos.read
- An album Ava can share
Refuse when outside the enforced resource restriction.
Delete a photo in the selected album
- Operation within photos.read
- An album Ava can share
Refuse: photos.read is for reading photos.
Connecting OAuth and OpenID Connect
The printer can now read Ava's photos. But OAuth on its own doesn't tell the printer, in a standard way, which account just signed in.
OpenID Connect, or OIDC, the federationAn arrangement that lets systems accept identity information from another trusted system, so an application can rely on a sign-in performed by a separate identity provider. standard from Trust across systems, adds that. Alongside the access token, the client can receive an ID tokenIn OpenID Connect, a signed JWT from the provider, addressed to one client, saying which account authenticated, when, and in answer to which request. It reports a sign-in and is not used to call APIs. describing Ava's sign-in. The ID token is for the printer itself, and the access token is for the photo API. They have different recipients and jobs, so the two tokens are not interchangeable.
Access token
- Defined by
- OAuth
- For
- The photo API
- Its job
- Lets a program call an API
Doesn't tell the printer which account just signed in
ID token
- Defined by
- OpenID Connect, on top of OAuth
- For
- The printer itself
- Its job
- Describing Ava's sign-in
Standardized authentication
They have different recipients and jobs, so the two tokens are not interchangeable.
Check your understanding
Try these questions before moving on. If an answer isn't right, use the feedback and try again.
Try it in the Lab
- Let an application read Ava's photos, then disconnect itGive the Token Decoder limited access, try an album outside that access, and see what happens to the old token when Ava disconnects.