php - OAuth 2.0 (Tokens) for Login Functionality
I am here with some general discussion very famous and interesting topic "Token Based Authentication".
I need my registered users to login with API. Scenario is quite simple, We want to pass our login details to Server. Server will check the credentials with database. If credentials are proper then Server will create "Session Id" and return back to user (client end). In subsequent requests user just need to pass that "Session Id" to authenticate and access protected data.
Plenty of people suggest about OAuth 2.0 and also some people suggest about Custom Logic. In custom logic they asked to be very sure about security. I read documentation of OAuth and it's good and descriptive. I'm also liking it to use. But wherever I search for OAuth authentication, they are giving example of third party login.
I had installed Php OAuth extension at my side for supporting this feature. In examples they asked to create Request Token first using "getRequestToken" function. Using that Request token they asked to call "getAccessToken" function to get "Access Token". Using that Access Token just need to call "fetch" to get protected data.
Now my questions are,
- In my scenario, Do i need Request Token? Is that possible to get Access Token directly
- What is OAuth Consumer Key and OAuth Consumer Secret key? Do I need such keys in my application? I believe it's used to allow third party applications only. In my case I'm the resource owner and i'm the consumer.
- Do you guys have any example for me to study?
- Do you know any well known framework for OAuth for PHP?
- Is that need any additional database support except "user" table? For storing OAuth details?
- Any additional documents to study for this would be highly appreciated.
I read different Grant Types in OAuth but confused how to use to achieve my approach.
Thanks in advance.
Answer
Solution:
From what I read, you do not need OAuth at all. OAuth is need if there is a third party involved that needs access to your user resources.
https://myserver.com/[email protected]&password=12345
'{user:[email protected]; sessionId=KJN93EJMQ3WEC9E8RCQJRE8F9E}'
Addtional considerations:
I think it standard stuff if not the logging in happening via REST.
Answer
Solution:
The requirement that I posted before to login with OAuth2.0.
Usually people assume that OAuth2.0 is only for fetching data by Third Party application from resource center behalf of Resource Owner. That approach is called Authorization Code.
OAuth2.0 has various "Authorization Grant". There are four types,
After research, I realize that "Resource Owner Credentials" is best suitable for me. I found one perfect library that helps you to understand background process internally. Here's the GitHub link to .
Found two major issues here,
If anyone has idea then please share.
Thanks,
Sanjay