Resource owner

As explained in Authorization in Action

A resource owner is the person or entity that controls protected data or resources and can authorize an application to access them.

A resource owner is the person or entity that controls protected data or resources and can authorize an application to access them. In OAuth, the owner grants limited access without sharing credentials. section 11.2.1

Kate illustrates the role: she owns documents and workspaces, BI Explorer requests access as the client, the authorization server issues tokens, and the resource server provides data after policy evaluation. section 11.2.1

Resource ownership participates in several authorization patterns:

• Ownership rules can let owners view or edit resources while managers or teams receive separate permissions. section 9.0
• Attribute-based access control (ABAC) can compare the requester’s department with the resource owner’s department alongside clearance, time, and network conditions. section 6.2.1
• Ownership does not bypass other controls: a token identifies delegated consent, while the resource server still evaluates authorization policies. section 11.2.1

Delegated access without password sharing

Kate authorizes BI Explorer to access selected Customer Collaboration APIs. The authorization service authenticates Kate and issues scoped tokens; BI Explorer presents them to the API, which checks what access is permitted. section 11.2.1

Figure 11.4 OAuth roles in action. Kate is the resource owner, BI Explorer is the client, ACME’s Customer Authentication Service is the authorization server, and the Customer Collaboration API is the resource server.

Use the role diagram to trace how the resource owner relates to the client, authorization server, and resource server. section 11.2.1

How Authorization in Action covers it

How deep it goes

Explains the role through an OAuth scenario and connects ownership to ABAC and Cedar policies without detailing token or policy syntax.

Examples

Uses Kate, BI Explorer, documents, workspaces, department attributes, clearance, time, and network risk as access examples.

What you can do after

Evaluate/understand how ownership, delegated consent, tokens, and runtime authorization combine in protected-resource access.

How it connects

Connects resource ownership to OAuth, clients, authorization servers, resource servers, Cedar, ABAC, and authorization policies.

liveBookmanning.com

Read Authorization in Action on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Acing the CCNA Exam: Volume 2 Advanced Networking and SecurityA resource owner is the entity that can grant an application permission to access a protected resource.

Compare how 2 books explain resource owner →

Related concepts

• OAuthpart of · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
• sender-constrained tokenused by · A sender-constrained token is a token cryptographically or transport-layer bound to a particular legitimate presenter so that possession alone is insufficient for its use.
• OAuth scopeconfigures · An OAuth scope is a named authorization specifying the access rights granted to a client or token.
• remediationuses · Remediation is the process of correcting, containing, or reducing the effects of an identified weakness, fault, vulnerability, or incident.

This explainer was generated by Manning's knowledge graph from the text of Authorization in Action. The section links point to the parts of the book it draws on.