Advanced API Security: OAuth 2.0 and Beyond

© Prabath Siriwardena 2020

P. SiriwardenaAdvanced API Securityhttps://doi.org/10.1007/978-1-4842-2050-4_19

UMA Evolution

Prabath Siriwardena¹ 

(1)

San Jose, CA, USA

 

User-Managed Access (UMA, pronounced “OOH-mah”) is an OAuth 2.0 profile. OAuth 2.0 decouples the resource server from the authorization server. UMA takes one step forward: it lets you control a distributed set of resource servers from a centralized authorization server. It also enables the resource owner to define a set of policies at the authorization server, which can be evaluated at the time a client is granted access to a protected resource. This eliminates the need for the resource owner’s presence to approve access requests from arbitrary clients or requesting parties. The authorization ...