OAuth and OIDC

  1. OAuth 2.0 Framework Fundamentals
    1. Core Principles
      1. Delegated Authorization
        1. Principle of Least Privilege
          1. Delegation vs Impersonation
          2. Token-Based Access Control
            1. Bearer Token Model
              1. Stateless Operations
                1. Token Lifecycle Management
                2. Separation of Concerns
                  1. Authentication vs Authorization
                    1. Client vs Resource Server
                  2. Key Terminology
                    1. Protected Resources
                      1. Access Tokens
                        1. Authorization Grants
                          1. Client Applications
                            1. Resource Owners
                            2. OAuth 2.0 Roles
                              1. Resource Owner
                                1. Definition and Responsibilities
                                  1. Delegation Authority
                                  2. Client
                                    1. Definition and Types
                                      1. Client Registration
                                        1. Client Authentication
                                          1. Confidential Clients
                                            1. Characteristics
                                              1. Security Requirements
                                              2. Public Clients
                                                1. Characteristics
                                                  1. Security Limitations
                                                2. Authorization Server
                                                  1. Core Responsibilities
                                                    1. Authentication Services
                                                      1. Token Issuance
                                                        1. Policy Enforcement
                                                        2. Resource Server
                                                          1. Protected Resource Hosting
                                                            1. Token Validation
                                                              1. Access Control Enforcement
                                                            2. Protocol Architecture
                                                              1. Request-Response Model
                                                                1. HTTP-Based Communication
                                                                  1. Endpoint Interactions
                                                                    1. Security Boundaries

                                                                  Previous

                                                                  1. Introduction to Secure Delegated Access

                                                                  Go to top

                                                                  Next

                                                                  3. OAuth 2.0 Protocol Endpoints