1) Eliminate the need for users to reveal their password to apps

2) Restrict the level of data available to apps

3) Allow users to revoke access to their data

1) Minimize how many passwords users need

2) Optimize sign-up flows to onboard users faster

• Terminology
• Why do we have OAuth 2.0?
• Authorization: JS, server-side, mobile
• Authentication
• What's this controversy?
• Resources

Don't want to see the warning here?

Then you must:

• Register your app
• Use cryptographic signatures on every request!

Standardized web-based flow like Secure AuthSub

• Still didn't rely upon SSL/TLS for APIs
• Painful cryptographic signatures on every request!

Standardized flows

• Relies upon SSL/TLS for APIs
• (Mostly) eliminates cryptographic signatures

<script type="text/javascript">
    var clientId = '387636757294.apps.googleusercontent.com';
    var authorizationUrlBase = 'https://accounts.google.com/o/oauth2/auth';
    var redirectUri = 'https://taskmandemo.appspot.com/oauth2callback.html';
    var scope = 'https://www.googleapis.com/auth/tasks';

    function startOauth() {
      var url = authorizationUrlBase;
      url += '?response_type=token'
          +  '&redirect_uri=' + encodeURIComponent(redirectUri)
          +  '&client_id=' + encodeURIComponent(clientId)
          +  '&scope=' + encodeURIComponent(scope);
      var w = window.open(url, 'oauth', 'width=500,height=400');
    }
</script>

https://accounts.google.com/o/oauth2/auth?
  client_id=387636757294.apps.googleusercontent.com&
  scope=https://www.googleapis.com/auth/tasks&
  redirect_uri=https://taskmandemo.appspot.com/oauth2callback.html&
  response_type=token

https://taskmandemo.appspot.com/oauth2callback.html#
    access_token=ya29.AHES6ZT8XLGWjlrYfP1KvkLQVvYj81C6uA_bUsaZBKWB4ZE&
    token_type=Bearer&
    expires_in=3600

GOAL!

• How do I get the token back to the app from the popup window?
• How do I get another access token?
• What happens if the user isn't logged in?

• You're looking for simplicity
• You like coding in JavaScript
• You only need access when the user is logged into their account at the API provider

https://accounts.google.com/o/oauth2/auth?
  client_id=387636757294.apps.googleusercontent.com&
  scope=https://www.googleapis.com/auth/tasks&
  redirect_uri=https://taskmandemo.appspot.com/oauth2callback&
  response_type=code&
  access_type=offline

https://taskmandemo.appspot.com/oauth2callback?
    code=4/jHpY6Rslb32PWBiR9bU6wJ4GrMmF.EjOUBPzd

# nothing to see here!

• When do refresh tokens expire?
• How do I store the refresh tokens?

decorator = OAuth2Decorator(
  client_id='387636757294.apps.googleusercontent.com'
  client_secret='-8IwOyyundwNY6W0B'
  scope='https://www.googleapis.com/auth/tasks')

http = httplib2.Http(memcache)
service = build("tasks", "v1", http=http)

class MainHandler(webapp.RequestHandler):
  @decorator.oauth_required
  def get(self):
    http = decorator.http()
    tasks = service.tasks.list(tasklist='@default').execute(http)

• You're looking for long-lived access to user data
• You need access when the user isn't at the keyboard
• You need to call the API from server-side code

• Resource Owner Password Credentials
• App-based Authorization
  • Client Credentials
  • JWT Assertion

Space-delimited list!

https://www.googleapis.com/auth/tasks https://www.googleapis.com/auth/plus.me

• Cross-platform - Embedded WebViews
• Cross-platform - System web browser
• Android-specific - GoogleAuthUtil

// Allow user to select an account
// AccountManager.getAccountsByType("com.google");

String scope = "https://www.googleapis.com/auth/tasks";

// Get an access token for 'email' account and requested scope
String token = GoogleAuthUtil.getToken(context, email, scope);

GOAL!

Sign up with Google

First name:
Last name:
Email:
Profile:

• Make it faster and easier to onboard users
• Securely get a unique, stable user identifier
• Personalize your site

https://www.googleapis.com/oauth2/v1/tokeninfo?
  access_token=

{
 "issued_to": "387636757294.apps.googleusercontent.com",
 "audience": "387636757294.apps.googleusercontent.com",
 "user_id": "113487456102835830811",
 "scope": "https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email",
 "expires_in": 3574,
 "email": "ryan@ryguy.com",
 "verified_email": true,
 "access_type": "online"
}

https://www.googleapis.com/oauth2/v1/userinfo?
  access_token=

{
 "id": "113487456102835830811",
 "email": "ryan@ryguy.com",
 "verified_email": true,
 "name": "Ryan Boyd",
 "given_name": "Ryan",
 "family_name": "Boyd",
 "link": "https://plus.google.com/113487456102835830811",
 "picture": "https://lh4.googleusercontent.com/-BET-bMzn99g/AAAAAAAAAAI/AAAAAAAAAQ8/wV0kQ3VUjOE/photo.jpg",
 "gender": "male",
 "birthday": "0000-10-05",
 "locale": "en"
}

<script src="http://plus.google.com/js/plusone.js"></script>
<div id="signinButton">
  <span class="g-signin"
    data-scope="https://www.googleapis.com/auth/plus.login"
    data-clientid="387636757294.apps.googleusercontent.com"
    data-redirecturi="postmessage"
    data-accesstype="offline"
    data-cookiepolicy="single_host_origin"
    data-callback="handleAuthResult">
  </span>
</div>
<div id="result"></div>

function handleAuthResult(authResult) {
  alert(authResult['access_token']);
}

GOAL!

• It's only a Framework, not a Specification
• Bearer Tokens are Bad; Signatures are Important
• Expiring Tokens are Painful
• Standards Committees are Rotten

• These slides - oauth2-preso.appspot.com
• APIs Console - developers.google.com/console
• JavaScript library - code.google.com/p/google-api-javascript-client
• Python library - code.google.com/p/google-api-python-client
• OAuth 2.0 Playground - developers.google.com/oauthplayground
• OAuth 2.0 Login Demo - oauthssodemo.appspot.com
• Google Play Services - developers.google.com/android/google-play-services