Databases
StackOverflow2013
Postsdbo
POHow would one secure multiple resource servers using OAuth 2.0?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POHow would one secure multiple resource servers using OAuth 2.0?
    primarykey
    data
    text
    <p>Consider the following distributed system that uses OAuth 2.0 for authorization and OpenID 2.0 for authentication.</p> <p><img src="https://i.stack.imgur.com/o7yxa.png" alt="enter image description here"></p> <p>Where </p> <ol> <li>RS1, RS2 and RS3 are "Resource Servers" (aka three different REST APIs)</li> <li>APP1 and APP2 are clients</li> <li>AS is an "Authorization Server" for managing OAuth tokens</li> <li>OPENID is an OpenID 2.0 provider.</li> </ol> <p>APP2 uses RS1, which in turn is uses resources on RS2 and RS3. There is a trust between RS1, RS2, RS3, APP2, AS and OPENID as they are developed by the same company (but different teams). When a user access APP2 for the first time, APP2 is automatically authorized to access resources on RS1, RS2 and RS3 on behalf of the user.</p> <p>APP1 uses resources in RS2, which in turn uses resources in RS3. APP1 is a third party website which is not trusted and a user needs to explicitly authorize APP1 to get access to resources on RS2 and RS3.</p> <p>Most examples regarding OAuth 2.0 shows the communication between a single resource and authorization server and how to request, issue and manage the tokens.</p> <p>How would one secure this environment using OAuth 2.0? For example, would APP2, RS1 and RS2 have their own client identifier and client secret (as they are all "clients" to another server)? If so, how would one issue access tokens for RS1 when it tries to access resources on RS2 and RS3 for the first time in the middle of another request (coming from APP2)? </p> <p>I already have AS, OPENID, APP2 and RS1, which was developed using ASP.NET MVC 3, WCF 4 and DotNetOpenAuth 4. I'm trying to introduce RS2, RS3 and APP1 into the system but struggle to figure out how authorization between the resource servers and clients will work. Everything runs under IIS 7.5 and HTTPS.</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. This table or related slice is empty.
    1. USbloudraak
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POHow would one secure multiple resource servers using OAuth 2.0?
      1. USbloudraak
      1. VTFavorite
    2. VO
      singulars
      1. POHow would one secure multiple resource servers using OAuth 2.0?
      1. This table or related slice is empty.
      1. VTUpMod
    1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload