OAuth

Terminology

In this example user hase images on Google Drive and wants to print them at some external Printing Service

Protected Resource - images on Google Drive

Resource Owner - user who owns images, he has access to Protected Resource and he can grant access rights

Resource Server - service where Protected Resource is stored. In this example it is Google Drive

Client - application that needs to access Protected Resource on behalf of the Resource owner and with its authorization. In this example it is Printing Service

Authorization Server - service responsible for authorized acces to Protected Resource. It is issuing Access Tokens to the Client

Workflow

Authorization Code Flow

Brief Description

	Source		Destination	Message / Action
	Resource Owner	→	Client	Do something with my Protected Resource
	Client	→	Authorization Server	Need access to Protected Resource
	Authorization Server	→	Resource Owner	Should I give access to your Protected Resource?
	Resource Owner	→	Authorization Server	Yes
	Authorization Server	→	Client	Authorization Token
	Client	→	Authorization Server	Authorization Token + Give me Access Token
	Authorization Server	→	Client	Access Token
	Client	→	Resource Server	Access Token + Give me access to Protected Resource
	Resource Server	→	Client	Access to Protected Resource

1 The User (Resource Owner) addresses the Client with a request to print their photos (Protected Resource) Google Drive (Resource Server)

User: …«Print photos»… → Client

(2) The Printing Service (Client) communicates to the Authorization Server that it needs to print photos. The user (Resource Owner) transmits data about the user and about the photos to which he needs access.

Client: … «Need access to certain photos of this user»… → Authorization Server

(3) Authorization Server accesses Resource Owner and informs that Client has requested access to Protected Resourse and He wants to do certain things. Question: Do you agree with Resource Owner?

Authorization Server: …«Do you agree to allow certain actions on the Protected Resource?»… → Resource Owner

4) Resource Owner says it's OK

Resource Owner: …« Yes, I agree to grant certain access to certain Protected Resources»… → Authorization Server

5) Authorizaion Server sends to the client (Client) Authorization Token . This is usually a short-lived token.

Authorization Server: …Authorization Token… → Client

6) Client requests from Autorization Server Access Token . To this request It adds the previously received Authorization Token .

Client: …« Give me the Access Token, I have the Authorization Token, here it is: » + Authorization Token… → Authorization Server

(7) Authorizaion Server checks Authorization Token and sends it to the Client. Access Token

Authorization Server: …Access Token… → Client

8) Client and sends to Resource Server Access Token and request access to Protected Resources

Client: …«Give me access to Protected Resource, I have Access Token here it is:» + Access Token &hellip. → Resource Server

9) Resource Server check out Access Token and gives Client access to Protected Resources

Resource Server: … Access to Protected Resource … → Client