A resource server is an application backend that hosts data, handles business logic, and enforces authorization on requests carrying access tokens. It trusts an identity provider (IdP) to authenticate users or clients, then applies the appropriate restrictions to backend resources. section 12.2 section 12.5
A resource server participates in OAuth 2 and OpenID Connect alongside:
- A user, who requests protected data or actions. section 12.2
- A client, such as a browser application, mobile application, or service, which sends requests to the backend. section 12.2
- An IdP or authorization server, which authenticates users or clients and issues tokens. section 12.5
- The resource server, which receives requests, validates their tokens, and authorizes access to resources. section 12.2 section 12.5
In the authorization code flow, a client obtains an access token after the user authenticates, then presents that token to the resource server. A signed token can be checked cryptographically with a public key obtained from the IdP; an unsigned or opaque token requires token introspection, in which the backend asks the IdP whether the token remains valid. section 12.2.1 section 12.5
A protected shopping list
Jeanny asks a client to display her shopping list. After authentication, the client receives an authorization code, exchanges it for an access token, and uses the token to request the list from the resource server. The backend then responds according to the authorization represented by the request. section 12.2.1
Service-to-service access
A payment service can act as a resource server when an ACME service authenticates directly with an IdP through the client credentials grant, receives an access token, and sends authorized payment requests without user involvement. section 12.2.3
Figure 12.7 Verifying the authenticity of a signed token. When the resource server receives a signed token, it uses a public key to validate the token. The resource server obtains this public key from the IdP, allowing it to verify that the token is valid.
Use the token-validation diagram to follow how a resource server obtains an IdP public key and verifies a signed token. section 12.2.1
