RFC 6749 - 4장 Obtaining Authorization

Obtaining Authorization

OAuth 2.0에서 권한을 얻는 다양한 방법

Authorization Code Grant

Authorization Request

• response_type="code"
• client_id
• redirect_uri
• scope
• state

Authorization Response

• code
• state

Access Token Request

• grant_type="authorization_code"
• code
• redirect_uri
• client_id

Access Token Response

• access_token
• expires_in
• token_type
• refresh_token (optional)

Implicit Grant

JavaScript 같은 scripting language application

redirection-based flow

Authorization Request

• response_type="token"
• client_id
• redirect_uri
• scope
• state

Access Token Response

• access_token
• token_type
• expires_in
• scope
• state

Resource Owner Password Credentials Grant

client는 resource owner의 credentials를 전달하되 access token을 발급하고나서 바로 버려야 한다.

Authorization Request and Response

• grant_type="password"
• username
• password
• scope

Access Token Response

• access_token
• expires_in
• token_type
• refresh_token (optional)

Client Credentials Grant

Authorization Request and Response

client authentication만 사용하기 때문에 추가적인 authentication은 필요하지 않다.

Access Token Request

• grant_type="client_credentials"
• scope

Access Token Response

refresh_token은 포함되지 않는다.

• access_token
• token_type
• expires_in

Extension Grants

SAML2 등 추가적인 grant_type 정의 가능