1

Well, I am a new guy on security domain and I am trying to understand OAuth 2.0 protocol. The next statement from rfc6749 is not that clear for me:

In the traditional client-server authentication model, the client requests an access-restricted resource (protected resource) on the server by authenticating with the server using the resource owner’s credentials.

Why is it said that client uses resource owner credentials? Typically, a lot of different users can access resource if they are granted to do this. Are they all considered as resource owners or what? Who is the resource owner?

P.S. Sorry for a newbie question.

4

1 回答 1

2

There is just one resource owner. The OAuth protocol talks about protected resources and not files that you upload on the internet for someone to download.

Take facebook as an example, your news feeds/wall etc are the protected resources that only you (the owner) can access. OAuth lets other people access these resources with certain constraints. (Yes, the app that keeps posting to your wall on your behalf is an example of this).

Traditionally, when you want someone to access your protected resource (say, write something on your FB wall on your behalf, something like updating your status message), you would have to give them your username + password. This is what the statement

In the traditional client-server authentication model, the client requests an access-restricted resource (protected resource) on the server by authenticating with the server using the resource owner’s credentials.

means.

With the advent of OAuth, you can let other people, apps access your protected resource without having to disclose your credentials. That is what happens when you start an app on Facebook, and asks for permissions - App would like to access your public info and so on..

Do read this small article. It explains with a real life example as to how OAuth works.

于 2013-08-09T09:27:59.573 回答