Skip to main content
OAuth 2.0 is an IETF standard protocol for SSO authorization. Below are the key roles within this framework:
  • Resource owner - Actor who owns the resources that a client is trying to access on the actor’s behalf.
  • Authorization server - Server that authenticates credentials and issues tokens to the client.
  • Resource server - Component that accepts tokens from the client in exchange for access to resources.
  • Client - Application that initiates interactions, receives tokens, and redeems them to access resources.
In the standard OAuth Authorization Code Grant flow, a resource owner uses a client to access resources that they own. The client presents user credentials to the authorization server, and the server provides an access token that represents the resource owner’s consent to access those protected resources. The client then supplies that token to the resource server to authenticate and request for specific resources. Authorization code grant flow Note: In many cases, the authorization server and resource server are in the same system. The Authorization Code Grant is one of several flows that a client can use to obtain an opaque access token (and optionally, a refresh token). Each OAuth Grant type is appropriate for a particular kind of client, and they are organized according to type.