Authorization Server
In OAuth 2.0, the component that authenticates the resource owner, obtains their authorization, and issues access tokens to clients. It exposes the authorization and token endpoints and, in OpenID Connect deployments, also acts as the OpenID Provider issuing ID tokens.
The distinction between an authorization server and an identity provider is worth keeping straight even though one product usually does both. The authorization server's job is delegation: deciding what a client may do on a user's behalf and issuing a token scoped to it. Identity provision is authentication: asserting who the user is. Ory's architecture makes the split explicit by running an OAuth server that holds no user credentials at all.
See also: OAuth, access token, scope, identity provider, relying party, authorization server metadata, protected resource metadata, token introspection, dynamic client registration, Client ID Metadata Document
Related on Start with Identity
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- GlossaryDevice Authorization Grant
An OAuth 2.0 flow (RFC 8628) for input-constrained devices like TVs and CLIs. The user authorizes on a second device using a short code. Device code flow is the
- GlossaryGNAP (Grant Negotiation and Authorization Protocol)
GNAP, the Grant Negotiation and Authorization Protocol ([RFC 9635](https://www.rfc-editor.org/rfc/rfc9635), Proposed Standard, October 2024), is an IETF delegat
- CVEF5 BIG-IP APM heap overflow in the OAuth authorization server, exploited as a zero-day
BIG-IP APM configured as an OAuth authorization server had a heap overflow that unauthenticated traffic could turn into remote code execution. CVSS 9.8, exploit
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.