Geek Answers Handbook

Centralized API provider - oAuth or not?

I got a little lost due to information overflow, and I need some guidance on the best way to support API access to trusted clients.

Current Wednesday:

We currently have a centralized server that handles user authentication / authorization through Apache Shiro.

We have our own APIs that interact with a centralized server for authentication and token management. (Thus, the inclusion of SSO).

The connection between our client applications and APIs is provided by SSL.

Token based authentication is used.

Purpose:

Our goal is to allow third-party applications and APIs to communicate with our centralized authentication server. But our main problem is phishing, because we want the “real” parties to communicate with us and, preferably, prohibit the disclosure of authentication information to a third party.

Questions:

1. What is the best way to implement such an architecture? Should we go ahead with OAuth? If so, is there a good way to integrate it with Shiro?

2- Will OAuth work well on mobile apps? (for example, deny access to the REST API if the application is not trusted)

3. Is there an OAuth provider library that I can use with Java, or is OAuth just a “standard” that I have to implement myself? (For example, to implement the RESTful API)

4- Is SSO supported with OAuth?

Sorry for the vague questions. I just need general recommendations and advice.

+7
source share
2 answers

Here are my answers in order

  • OAuth 2.0 is best for you. I would say you should go for OAuth.
  • Definitely yes.
  • There are libraries. Apache Oltu and the Google Client Library.
  • The OpenID Connect specification, which is built on top of OAuth, can be used to implement SSO.
+2
source
  • Mobile apps work great with OAuth.
  • SSO can be enabled using OAuth.

Some information on how to configure the OAuth server / provider - How does the efficient OAuth2.0 server / provider work?

As you say, you need to ask the user to authorize the application (accept / ban permissions that the application requests) is an ideal use case for OAuth 2.0.

Feel free to follow if you need to understand more about how OAuth works.

PS - I do not know about integration with Shiro.

+2
source

More articles:


All Articles