OAuth 2.0 is an authorization framework for letting an application obtain permission to access protected resources without handling the user’s password. It separates authentication and authorization responsibilities into an identity provider (IdP), client, and resource server. section 12.2 section 13.0
This separation supports single sign-on: employees and customers can use one existing account across multiple applications instead of creating and storing credentials everywhere. OAuth 2.0 provides authorization; OpenID Connect adds authentication and user identity. section 12.0 section 13.5
The main actors and mechanisms are:
- The user owns the protected data; the client is the web, mobile, or service application used directly. section 12.2
- The IdP, also called the authorization server, authenticates users and manages client details; the resource server protects backend resources and applies authorization. section 12.2
- The authorization code grant handles user interaction, while the client credentials grant authenticates one application to another without user involvement. section 12.5
- Access tokens authorize requests; ID tokens carry user information in OIDC, commonly using JWTs with claims and a signature. section 12.5
- PKCE strengthens authorization for public clients, and refresh tokens obtain new short-lived access tokens without repeated login; protect, rotate, expire, and revoke refresh tokens. section 13.0 section 13.5
A practical SSO scenario
An employee uses several ACME applications during the workday, while a customer wants to use an existing social-login account for the online store. An IdP handles authentication once, clients obtain tokens, and each resource server uses those tokens to authorize access. The applications avoid collecting another set of usernames and passwords. section 12.0 section 12.5
