OAuth - Open API Authentication

Slideshow Transcript

1. Slide 1: OAuth Basic Introduction
2. Slide 2: What is OAuth? A simple open standard for secure API authentication.
3. Slide 3: The Love Triangle End User Service Provider Consumer Application (fake applications by EHL) http://www.hueniverse.com/hueniverse/2007/10/oauth-end-user-.html
4. Slide 4: Specifically OAuth is... • Authentication Need to log in to access parts of a website ex: bookmark a link, post a photo, add a friend, view a private message • Token-based Authentication Logged-in user has a unique token used to access data from the site
5. Slide 5: Similar to... • Flickr Auth • Google’s AuthSub • Yahoo’s BBAuth • Facebook Auth • and others...
6. Slide 6: Who is involved?
7. Slide 7: Goals: Be Simple • standard for website API authentication • consistent for developers • easy for users to understand * * this is hard
8. Slide 8: Goals: Be Secure • secure for users • easy to implement security features for developers • balance security with ease of use
9. Slide 9: Goals: Be Open • any website can implement OAuth • any developer can use OAuth • open source client libraries • published technical specifications
10. Slide 10: Goals: Be Flexible • don’t need a username and password • authentication method agnostic • can use OpenID (or not!) • whatever works best for the web service • developers don’t need to handle auth
11. Slide 11: What the end user sees... an example from ma.gnolia and nsyght.
12. Slide 12: OMG! Need to login!
13. Slide 13: Login with service provider
14. Slide 14: Authorize
15. Slide 15: Done!
16. Slide 16: How Does OAuth Work? (for developers)
17. Slide 17: Register a Consumer Application • Provide service provider with data about your application (name, creator, url etc...) • Service provider assigns consumer a consumer key and consumer secret • Service provider gives documentation of authorization URLs and methods
18. Slide 18: Authorization Process 1. Obtain request token 2. User authorizes request token 3. Exchange request token for access token 4. Use access token to obtain protected resources
19. Slide 19: OAuth Parameters • oauth_consumer_key • oauth_token • oauth_signature • oauth_signature_method • oauth_timestamp • oauth_nonce
20. Slide 20: Where is this information passed? • HTTP Authorization header • HTTP POST request body (form params) • URL query string parameters
21. Slide 21: Security • Tokens - aren’t passing username/password • Timestamp and nonce - verify unique requests • Signature - encrypted parameters help service provider recognize consumer • Signature methods - HMAC-SHA1, RSA- SHA1, Plaintext over a secure channel (such as SSL)
22. Slide 22: Current Status of OAuth • oauth.net • Auth Core 1.0 Draft 7 • several libraries Python, Ruby, Perl, C# ...) for consumers and service providers (PHP, • Ma.gnolia and Twitter implementations • more implementations soon!
23. Slide 23: Thanks! Chris is still working on the logo...