Authorization Server: Difference between revisions
Jump to navigation
Jump to search
| Line 13: | Line 13: | ||
Specific virtual solutions: | Specific virtual solutions: | ||
===Healthcare=== | ===Healthcare=== | ||
See the wiki page [[Patient Consent]] for details on getting permission to issue a token for health recous. | |||
==References== | ==References== | ||
Revision as of 01:05, 17 April 2020
Full Title
Access tokens are issued to third-party clients by an Authorization Server with the approval of the resource owner. The client uses the access token to access the protected resources hosted by the resource server. Taken from RFC 6749
Context
- The ultimate purpose of most user authentication is to allow the user, or the user's client, to access protected resources. The abstract concept of an Authorization Server is just the source of the tokens that are sent to the Resource Server to give it the authority it needs to provide access to the protected asset.
- For the purposes of Identity Management this wiki will focus on the use of the Authorization Server.
Problems
- There are a wide range of attacks on the web to try to illegitimately acquire access to protected resources. Nearly of the complexity associated with an Authorization Server to to mitigate those threats.
Solutions
Specific virtual solutions:
Healthcare
See the wiki page Patient Consent for details on getting permission to issue a token for health recous.
References
- D. Hardt, The OAuth 2.0 Authorization Framework IEtF 6749 https://www.rfc-editor.org/rfc/pdfrfc/rfc6749.txt.pdf