Cloud Native Data Security with OAuth

Chapter 14. User Authentication

You might be surprised that you’re reading a book about OAuth, yet you find user authentication in the last chapter. This is our deliberate decision. We believe that too many OAuth tutorials focus on logins, but this is not the specification’s foundation. We want you to understand API authorization before we dive in into user authentication so that your clients receive correctly issued access tokens. That is, the ultimate goal of user authentication is to identify a user to your APIs. When doing so, you want a level of assurance that a malicious party does not impersonate the real user.

The OAuth specification leaves the topic of user authentication open—all it says is that the authorization server has to authenticate the user during an OAuth flow. The authorization server can choose what user authentication methods it implements. Of course, this does not mean that authentication is simple or irrelevant. On the contrary, authentication is an essential prerequisite of authorization so that the authorization server can collect information about the subject and the authentication event to issue to access tokens.

In this chapter, we want you to understand the business possibilities when you utilize user authentication in an OAuth architecture. We first show how a modern user authentication flow works, to externalize complexity from clients and issue them with correct access tokens. We then describe the types of user authentication methods you can use. ...