4.4.1 OAuth2 Roles

OAuth2 consists of the following four roles:

  • Resource Owner: A system or a person (end-user) who owns the resource and grants access to it.

  • Resource Server: A server that hosts the protected resources. It accepts and validates requests from the Client to grant access to the resource.

  • Client: An application that requests and gets authorization on behalf of the resource owner to access the protected resource. For example, Privileged Access Manager.

  • Authorization Server: A server that provides access tokens to the Client after validating the resource owner and obtaining authorization. For example, Advanced Authentication server.

The following diagram describes the flow of authorization:

Figure 4-1 Flow of Authorization Code

When a resource owner wants to access the client website or application, the following steps describe the flow of authorization code:

  1. PAM initiates the flow and directs the user agent of the resource owner to the authorization server. PAM includes its client identifier, requested scope, local state, and a redirection URI.

  2. The authorization server authenticates the resource owner through the user agent and recognizes whether the resource owner grants or denies the access request.

  3. If the resource owner grants access, PAM uses the redirection URI provided earlier to redirect the user agent back to the corresponding account or resource. The redirection URI includes an authorization code and any local state previously provided by PAM.

  4. PAM requests an access token from the authorization server through the token endpoint. Then PAM authenticates with its client credentials and includes the authorization code received in the previous step. PAM also includes the redirection URI used to obtain the authorization code for verification.

  5. The authorization server validates the client credentials and the authorization code. The server also ensures that the redirection URI received matches the URI used to redirect the client in Step 3. If valid, the authorization server responds back with an access token.