DE EN IT

~/glossary / Identity & SSO

OAuth 2.0

OAuth 2.0 is an authorization framework that lets an application access a resource on behalf of a user without receiving the user's password.

daniele@mikweb: ~/glossary — man oauth-2-0

Instead of a password, the application gets an access token from the authorization server, limited in lifetime and scope. A refresh token lets it obtain new access tokens without the user signing in again.

For interactive applications the Authorization Code flow with PKCE is the standard; for service-to-service access, the Client Credentials flow. The once common Implicit flow and Password grant are deprecated.

Admins mostly meet OAuth 2.0 in mail: Microsoft 365 and Google require modern authentication via OAuth 2.0 instead of basic auth for IMAP and SMTP. Old devices and scripts that only support username and password stop working.

daniele@mikweb: ~/glossary — ls

Related terms

OpenID Connect (OIDC)OpenID Connect (OIDC) is a login protocol built on OAuth 2.0 that, in addition to access, delivers the user's identity as a signed ID token.JWT (JSON Web Token)A JWT (JSON Web Token) is a compact signed token that carries statements (claims) about a user or client in JSON form.Identity provider (IdP)An identity provider (IdP) is the central service that authenticates users and confirms their identity and attributes to applications.IMAPIMAP (Internet Message Access Protocol) is the protocol mail clients use to read, move and manage messages directly on the server.

← All terms