hmLoadTopic({
hmKeywords:"",
hmTitle:"OAuth2.0 Mode",
hmDescription:"OAuth 2.0 is an open standard for API authorization, which allows us to share information between sites without having to share identity.",
hmPrevLink:"ws_apikey.html",
hmNextLink:"ws_identityserver4.html",
hmParentLink:"ws_auth-modes.html",
hmBreadCrumbs:"<a href=\"ws_auth-modes.html\">Authentication Modes<\/a>",
hmTitlePath:"Authentication Modes > OAuth2.0 Mode",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">OAuth2.0 Mode<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_Normal\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-align: center;\"><img style=\"margin:0 auto 0 auto;width:43.7500rem;height:18.7500rem;border:none\" src=\".\/images\/modooauth.png\"\/><\/p>\n\r<p class=\"p_Normal\" style=\"text-align: center;\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-align: center;\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-align: center;\">&nbsp;<\/p>\n\r<p style=\"text-align: justify; line-height: 1.28; margin: 0 0 0.6875rem 0;\"><span style=\"font-size: 0.91rem; color: #000000;\">&nbsp;<\/span><br \/>\n\rOAuth 2.0 is an open standard for API authorization, which allows us to share information between sites without having to share identity.<\/p>\n\r<p style=\"text-align: justify; line-height: 1.28; margin: 0 0 0.6875rem 0;\"><span style=\"font-size: 0.91rem; color: #000000;\">&nbsp;<\/span><br \/>\n\rIt is a Framework that smooths the delegation of client authorization, verifying access to APIs. Therefore, it is not an authentication protocol but the provision of an access token to access a specific resource.<br \/>\n\r&nbsp;<br \/>\n\rIts purpose is to allow other providers, services or applications to access information without directly providing user credentials. <br \/>\n\r&nbsp;<br \/>\n\rAuthentication and authorization control is given to LinkarWS using Oauth 2.0 and OpenID standards. <\/p>\n\r<p style=\"text-align: justify; line-height: 1.28; margin: 0 0 0.6875rem 0;\">The different roles that OAuth 2.0 uses in the process are:<\/p>\n\r<p class=\"p_Normal\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 1.6250rem; margin-left: 0;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">o<\/span><a href=\"ws_clients.html\" class=\"topiclink\">Clients<\/a><br \/>\n\rThe application that wants to access the API is called Client.<br \/>\n\rBefore accessing, client must be authorized by the user, and such authorization must be validated by the API.<\/p><p class=\"p_Normal\"> &nbsp; &nbsp; &nbsp; The client can be a web application, a mobile application, a desktop application, a Smart TV application, an IoT device, another API that consumed from this API, etc.<\/p>\n\r<p class=\"p_Normal\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 1.6250rem; margin-left: 0;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">o<\/span>Resource Owner<\/p><p class=\"p_Normal\" style=\"margin: 0 0 0 1.6250rem;\">On LinkarWS we name it <a href=\"ws_identity-resources.html\" class=\"topiclink\">Identity Resources<\/a>. The owner of the resource is the user who gives authorization to a certain application to access his account and do some things on his behalf.<\/p>\n\r<p class=\"p_Normal\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 1.6250rem; margin-left: 0;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">o<\/span>Authorization Server. <br \/>\n\rThe authorization server is responsible of handling authorization requests. It verifies the identity of users and issues a series of access tokens to the client application.<\/p><p class=\"p_Normal\" style=\"margin: 0 0 0 1.6250rem;\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"margin: 0 0 0 1.6250rem;\">The returned token is of type JWT with the following structure:<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 0.8125rem; margin: 0 0 0 1.6250rem;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">o<\/span>Header: header indicating, at least, the algorithm and the type of token, which in this case is JWT.<\/p><p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 0.8125rem; margin: 0 0 0 1.6250rem;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">o<\/span>Payload: where the user data and privileges are described, as well as all the additional information.<\/p><p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 0.8125rem; margin: 0 0 0 1.6250rem;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">o<\/span>Signature: a signature that allows to verify if the token is valid.<\/p><p class=\"p_Normal\" style=\"margin: 0 0 0 1.6250rem;\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"margin: 0 0 0 1.6250rem;\">LinkarWS itself performs those functions, although it can also be outsourced to external identity servers, as in the case of the IdentityServer4 Mode that we will see later.<\/p>\n\r<p class=\"p_Normal\">&nbsp;<\/p>\n\r<p class=\"p_Normal\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 1.6250rem; margin-left: 0;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">o<\/span>Resource Server<\/p><p class=\"p_Normal\" style=\"margin: 0 0 0 1.6250rem;\">The resource server is the API itself, and in LinkarWS we name it API Resources.<\/p>\n\r<p class=\"p_Normal\">&nbsp;<\/p>\n\r<p class=\"p_Normal\">The elements of control for the access to the resources are defined in the Claims and Scopes:<\/p>\n\r<p class=\"p_Normal\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 1.6250rem; margin-left: 0;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">o<\/span><a href=\"ws_standard-claims.html\" class=\"topiclink\">Claims<\/a>. Name\/value pairs that contain information about a user. They provide a formidable way of trusting that the data is valid and true.<\/p><p class=\"p_Normal\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 1.6250rem; margin-left: 0;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">o<\/span><a href=\"ws_scopes.html\" class=\"topiclink\">Scopes<\/a>.Space-separated lists of identifiers used to identify resource access privileges. <\/p><p class=\"p_Normal\">&nbsp;<\/p>\n\r<p class=\"p_Normal\"><span style=\"font-weight: bold;\">The token request is made through the url ..\/api\/v1\/{identityresourcename}\/token<\/span><\/p>\n\r<p class=\"p_Normal\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-align: justify;\">LinkarWS offers the following <a href=\"ws_clients.html\" class=\"topiclink\">Grant Types<\/a>:<span style=\"font-weight: bold;\"> <\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-align: justify;\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-align: justify; text-indent: 0; padding-left: 1.6250rem; margin-left: 0;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">o<\/span><span style=\"font-weight: bold;\">Client credentials<\/span><br \/>\n\rIntended for server-to-server authentication, this flow describes an approach where the client application acts on its own behalf rather than on behalf of any individual user. In most cases, this flow allows users to specify their credentials in the client application, so they can access the resources under the client\'s control.<\/p><p class=\"p_Normal\" style=\"text-align: justify; margin: 0 0 0 1.6250rem;\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-align: justify; margin: 0 0 0 1.6250rem;\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-align: justify; margin: 0 0 0 1.6250rem;\">The token request must contain the following data:<\/p>\n\r<p class=\"p_Normal\" style=\"text-align: justify; margin: 0 0 0 1.6250rem;\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-align: justify; text-indent: 0; padding-left: 1.6250rem; margin: 0 0 0 1.6250rem;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">o<\/span>client_id and client_secret (defined in Clients)<\/p><p class=\"p_Normal\" style=\"text-align: justify; margin: 0 0 0 1.6250rem;\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-align: justify; text-indent: 0; padding-left: 1.6250rem; margin: 0 0 0 1.6250rem;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">o<\/span>list of scopes. (defined at the intersection of API Resources, Clients and Identity Resources).<\/p><p class=\"p_Normal\" style=\"text-align: justify; margin: 0 0 0 1.6250rem;\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-align: justify; text-indent: 0; padding-left: 1.6250rem; margin-left: 0;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">o<\/span><span style=\"font-weight: bold;\">Resource owner password<\/span><br \/>\n\rRequires logging in with username and password. In this case, the credentials will be part of the request. This flow is only suitable for trusted clients (e.g. official applications launched by the API provider).<\/p><p class=\"p_Normal\" style=\"text-align: justify; margin: 0 0 0 1.6250rem;\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-align: justify; margin: 0 0 0 1.6250rem;\">The token request must contain the following data:<\/p>\n\r<p class=\"p_Normal\" style=\"text-align: justify; margin: 0 0 0 1.6250rem;\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-align: justify; text-indent: 0; padding-left: 1.6250rem; margin: 0 0 0 1.6250rem;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">o<\/span>username and password (defined in Identity Resources)<\/p><p class=\"p_Normal\" style=\"text-align: justify; margin: 0 0 0 1.6250rem;\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-align: justify; text-indent: 0; padding-left: 1.6250rem; margin: 0 0 0 1.6250rem;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">o<\/span>client_id and client_secret (defined in Clients)<\/p><p class=\"p_Normal\" style=\"text-align: justify; margin: 0 0 0 1.6250rem;\">&nbsp;<\/p>\n\r<p class=\"p_Normal\" style=\"text-align: justify; text-indent: 0; padding-left: 1.6250rem; margin: 0 0 0 1.6250rem;\"><span class=\"f_Normal\" style=\"font-family: \'Courier New\';display:inline-block;width:0.8125rem;margin-left:-0.8125rem\">o<\/span>list of scopes. (defined at the intersection of API Resources, Clients and Identity Resources).<\/p><p class=\"p_Normal\" style=\"text-align: justify; margin: 0 0 0 1.6250rem;\">&nbsp;<\/p>\n\r<div class=\"p_Normal\" style=\"text-align: justify;\"><img style=\"width:80%;max-width:3792px;height:auto;border:none\" src=\".\/images\/blank.png\"\/><\/div>\n\r<p class=\"p_Normal\" style=\"text-align: justify;\">&nbsp;<\/p>\n\r"
})
