Cloud Native Data Security with OAuth

Chapter 4. OAuth Data Design

OAuth is a distributed architecture, and the authorization server has its own data sources. When you get started with OAuth, an early consideration should be to enable a future-proof data setup. You should be able to deploy the authorization server and its data in a straightforward manner. User attributes from the authorization server should flow to your APIs in a way that enables APIs to correctly authorize access to the user’s business resources.

In this chapter, we explain how an authorization server manages data. We then explain the design choices you have for operating this data. In particular, we discuss user accounts and user attributes. We also discuss manageability so that you get the right level of dependency between your APIs and your authorization server. We then cover some wider topics related to multitenancy and multiregion so that you can take your OAuth data with you as your business data grows. Finally, we show how to use the authorization server’s user management APIs to populate user accounts. First, let’s understand the types of data your authorization server uses.

Authorization Server Data

Your authorization server stores several types of identity data, which you manage separately from your business data. The types can be broadly categorized as configuration data, operational data, and user identity data. Figure 4-1 illustrates some example authorization server data.

Figure 4-1. Data managed by the authorization server

Your ...