How deeply does Building Distributed Applications that Work cover OAuth?

Defines OAuth's authorization role and sketches token-based sessions, but defers protocol details.

OAuth

As explained in Building Distributed Applications that Work

OAuth is an authorization framework that enables clients to obtain limited access to protected resources without handling the resource owner's credentials.

OAuth handles authorization: deciding whether a user may access a requested resource. It can work alongside OpenID Connect (OIDC), which handles authentication—proving who the user is. For example, a page restricted to administrators requires a permission check, not just a successful login. section 8.1

In single sign-on, a shared identity provider (IdP) supports access across protected applications. The flow obtains an access token after valid credentials are supplied and maintains the session by refreshing the token. OAuth's role in that flow is authorization; it is not the login mechanism. section 8.1 section 8.6

Online-shop access

An online shop needs to know who placed an order and protect accounts from impersonation and payment-card misuse. A Keycloak container acts as the IdP. Once the UI is authenticated, it can pass credentials and permission information to a backend API in a JWT; authorization determines whether access to a requested resource is permitted. section 8.1 section 8.6

How Building Distributed Applications that Work covers it

Cover of Building Distributed Applications that Work

liveBook manning.com

Read Building Distributed Applications that Work on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Software Security for DevelopersOAuth is an authorization framework that enables delegated access to protected resources without sharing the resource owner's credentials with the resource server.
liveBook manning.com

Authorization in ActionOAuth 2.0 is an open authorization framework that lets applications obtain limited delegated access to protected resources without exposing a user's credentials.
liveBook manning.com

.NET MAUI in ActionOAuth is an authorization framework that allows an application to obtain delegated access to protected resources without receiving the user's password.
liveBook manning.com

ASP.NET Core in Action, 3eOAuth 2.0 is an authorization protocol that lets a resource owner delegate controlled access to protected resources without revealing credentials to the accessing service.
liveBook manning.com

Acing the CCNA Exam: Volume 2 Advanced Networking and SecurityOAuth 2.0 is an industry-standard authorization framework that delegates controlled access to protected resources without sharing the resource owner's credentials with a third-party application.
liveBook manning.com

Secure APIsOAuth 2.0 is the earlier major version of the OAuth authorization framework that defined multiple authorization flows for delegated access.
liveBook manning.com

Spring Security in Action, Second EditionOAuth 2 is an authorization framework specification for delegated access to protected resources using access tokens.
liveBook manning.com

Spring in Action, Sixth EditionOAuth 2 is an authorization framework that enables a client to obtain limited access to protected resources on behalf of a resource owner.

Compare how 9 books explain OAuth →

Related concepts

openid connectused by · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
API keyproduces · An API key is a credential used to identify or authorize a client accessing an application programming interface.
scopeuses · Scope is a defined boundary specifying which entities, activities, resources, or conditions are included or governed in a particular context.
authenticationuses · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
authorization code flowhas part · The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
resource serverhas part · A resource server is a service that hosts protected resources, validates access credentials such as tokens, and enforces authorization for client requests.

This explainer was generated by Manning's knowledge graph from the text of Building Distributed Applications that Work. The section links point to the parts of the book it draws on.