Authorization Server
In OAuth 2.0, the component that authenticates the resource owner, obtains their authorization, and issues access tokens to clients. It exposes the authorization and token endpoints and, in OpenID Connect deployments, also acts as the OpenID Provider issuing ID tokens.
The distinction between an authorization server and an identity provider is worth keeping straight even though one product usually does both. The authorization server's job is delegation: deciding what a client may do on a user's behalf and issuing a token scoped to it. Identity provision is authentication: asserting who the user is. Ory's architecture makes the split explicit by running an OAuth server that holds no user credentials at all.
See also: OAuth, access token, scope, identity provider, relying party
Related on Start with Identity
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- GlossaryDevice Authorization Grant
An OAuth 2.0 flow (RFC 8628) for input-constrained devices like TVs and CLIs. The user authorizes on a second device using a short code. Device code flow is the
- GlossaryRefresh Token
A longer-lived credential used to obtain new access tokens without re-authenticating the user. Refresh tokens should be one-time-use (rotated on each exchange)
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEOAuth 2.0 private_key_jwt audience ambiguity
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted b