OAuth

As explained in Acing the CCNA Exam: Volume 2 Advanced Networking and Security

OAuth 2.0 is an industry-standard authorization framework that delegates controlled access to protected resources without sharing the resource owner's credentials with a third-party application.

OAuth 2.0 is an industry-standard authorization framework for delegating controlled access to protected REST API resources. A third-party application acts on a user’s behalf without receiving the user’s credentials. section 23.3.2 section 23.4

The basic authorization sequence is:

• The client application requests authorization from the resource owner. section 23.4
• The client receives an authorization grant and exchanges it with the authorization server for an access token. section 23.4
• The client presents the access token to the resource server to retrieve the desired protected resource. section 23.3.2 section 23.4

Figure 23.7 The basic OAuth 2.0 process. Through access delegation, the client application is able to access the resource owner’s protected resources on behalf of the owner.

Follow the process diagram to distinguish the resource owner, client application, authorization server, access token, and resource server. section 23.3.2

How Acing the CCNA Exam: Volume 2 Advanced Networking and Security covers it

How deep it goes

Explains the basic authorization sequence and its participants, but does not detail specific grant types or implementation configuration.

Examples

Uses a process diagram showing a client obtaining delegated access to a resource owner’s protected resource.

What you can do after

Apply it to understand how a client obtains an access token and uses delegated authorization to access protected API resources.

How it connects

Connects REST APIs with resource owners, client applications, authorization servers, resource servers, authorization grants, and access tokens.

liveBookmanning.com

Read Acing the CCNA Exam: Volume 2 Advanced Networking and Security on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Software Security for DevelopersOAuth is an authorization framework that enables delegated access to protected resources without sharing the resource owner's credentials with the resource server.
• 

  liveBookmanning.com
  Authorization in ActionOAuth 2.0 is an open authorization framework that lets applications obtain limited delegated access to protected resources without exposing a user's credentials.
• 

  liveBookmanning.com
  .NET MAUI in ActionOAuth is an authorization framework that allows an application to obtain delegated access to protected resources without receiving the user's password.
• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eOAuth 2.0 is an authorization protocol that lets a resource owner delegate controlled access to protected resources without revealing credentials to the accessing service.
• 

  liveBookmanning.com
  Secure APIsOAuth 2.0 is the earlier major version of the OAuth authorization framework that defined multiple authorization flows for delegated access.
• 

  liveBookmanning.com
  Spring Security in Action, Second EditionOAuth 2 is an authorization framework specification for delegated access to protected resources using access tokens.
• 

  liveBookmanning.com
  Spring in Action, Sixth EditionOAuth 2 is an authorization framework that enables a client to obtain limited access to protected resources on behalf of a resource owner.
• 

  liveBookmanning.com
  Building Distributed Applications that WorkOAuth is an authorization framework that enables clients to obtain limited access to protected resources without handling the resource owner's credentials.

Compare how 9 books explain OAuth →

Related concepts

• openid connectused by · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
• API keyproduces · An API key is a credential used to identify or authorize a client accessing an application programming interface.
• scopeuses · Scope is a defined boundary specifying which entities, activities, resources, or conditions are included or governed in a particular context.
• authenticationuses · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
• authorization code flowhas part · The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
• resource serverhas part · A resource server is a service that hosts protected resources, validates access credentials such as tokens, and enforces authorization for client requests.

This explainer was generated by Manning's knowledge graph from the text of Acing the CCNA Exam: Volume 2 Advanced Networking and Security. The section links point to the parts of the book it draws on.