Enterprise Integration Zone is brought to you in partnership with:

As the Technical Director, Europe for Layer 7 Technologies, Francois Lascelles advises global corporations and governments in designing and implementing secure SOA and cloud based solutions. Francois joined Layer 7 in its first days back in 2002 and has been contributing ever since to the evolution of the SecureSpan SOA infrastructure product line. Francois is co-author of Prentice Hall’s upcoming SOA Security book. Layer 7 Technologies is an Enterprise SOA and Cloud infrastructure provider. Follow me on twitter http://twitter.com/flascelles Francois is a DZone MVB and is not an employee of DZone and has posted 28 posts at DZone. You can read more from them at their website. View Full User Profile

Which Grant, Which Identities – Back from RSA

01.18.2013
| 1062 views |
  • submit to reddit
I had the pleasure of discussing REST access control patterns with Enterprise Architects and partnering technology folks a while back. I also had the opportunity to present on this topic and one of the questions that came up afterwards was from a security architect who was unsure whether OAuth would be a good fit for some existing APIs that they have because those APIs happen to be consumed from two very different sources:

  1. From the inside, by internal applications that do not act on behalf of a particular subscriber but from the provider’s perspective

  2. From the outside, by applications that act on behalf of individual subscribers

OAuth 2.0 provides 4 core grant types that address different situations. In the case of the example described above, you could use the client creds grant type for the first type of access. It should be possible to permit different scopes to different client ids. The internal client ids would be allowed to request wider scopes. For the second type of consumption, the external one, any of the other 3 grant types could be applicable.

Image

Hope to see you at RSA next year.

Published at DZone with permission of Francois Lascelles, author and DZone MVB. (source)

(Note: Opinions expressed in this article and its replies are the opinions of their respective authors and not those of DZone, Inc.)