Understanding Oauth 2.0 protocol.

Learn about the core understanding of Oauth 2.0 Protocol.
"Oauth is an authorization Protocol"
"Why you should use Oauth"
"Adds one more layer for authorization"
Do watch the entire video and you might learn something new.
This will be first video of the entire series that I will be creating for Oauth.
Below mentioned is link the can be used to check the federation metadata of your Azure AD for SAML application.
login.microsof...
Replace "common" with your tenant name.
Like - login.microsof...
For checking information related to Oauth endpoints replace common with your tenant name;
login.microsof...
If you have any feedback, suggestion or query please feel free to reach us at [e-mail].
Regards,
ConceptsWork.

[@_BiSwAjEeT_]

You did such an amazing job in your videos, that it can suits both novice3 and an experienced professional , I just revisit it if needed to revise the core concepts.

[@BhupiUncut]

Simply awesome and very deep dive information.

[@Southpaw07]

Thanks!

[@ConceptsWork]

Thank you.

[@nitishbharadwaj138]

Best video I have seen so far.

[@abulaith4485]

Excellent. Thank you.

[@sandeshkadam2512]

one thing I confused, in OAuth its authorization to user account who trying to access a resource or authorization to application from which user is trying to access a resource. In SAML\Ws-Fed Once user authenticated user will get the token & based on the claims in the token user will get the access to the resource but in OAuth both user & application (from which user is trying to access) needs to be authorized? Thanks for great video.

[@denisdm91]

I don't understand the difference between authorization and authentication and what is being referred to. oauth for example is the authorization protocol and openid is the authentication protocol.

[@rajatbakshi1691]

I am little confused here, when you setup a SAML app, you define what attributes(resources) the application can read for a user via SAML token. So the application is restricted to those predefined attributes values set by identity provider. It does not have unauthorized access over any other data in IDP side. 'The consent from user for the defined scopes' part in Oauth is definitely a plus over SAML but rest seem same. Sorry if I misunderstood anything here as my oAuth understanding is limited

[@ConceptsWork]

With SAML, you can only work with the attribute that you get from IDP. Also there is nothing like incremental consent or user specific consent. With Oauth, Everything can be managed, which means for the same app, you can develop multiple consent framework for different users. For example if you want to access lets say email of the user, you can request a specific scope, but then lets say you want to read sign in info, you can just change the scope with incremental alterations and everything remains same. NO change is required at the IDP layer.

[@sachinkamboj8426]

Thanks a lot. Oauth and Single sign on is same thing ? How service could find two different devices from where the user logged in. Do we send IP address to the identity server some how?

[@ConceptsWork]

Oauth is an authorization protocol, where as Single sign on is a mechanism. Regarding user session, these capabilities depend upon the identity provider itself and yes, id address plays a crucial role in this kind of analysis.

[@ravimohindroo8560]

I have a question about the roles we have in oauth and idconnect. Outlook and exchange are 2 application and when we access exchange using outlook or owa using desktop or mobile. Which roles is it? Is outlook app is client? Or exchange is client app? I understand it's confidential client application...but how does it fit the flow?

[@ConceptsWork]

Exchange is a service in this case, which is access by outlook. Outlook rich client app on the device and OWA portal, both will be treated as client app, to have a correlation in terms of verifying what I just said, please check sign in activity of any user and you will be able to relate. :-)

[@ravimohindroo8560]

@@ConceptsWork thanks! Will do.

[@ibandari3473]

Thank you so much

[@ConceptsWork]

You're most welcome

[@sahilroyal8939]

@@ConceptsWork Please explain on behalf of (obo) oauth flow too!

[@lifeisbeautiful2048]

Nice one

[@ConceptsWork]

Thanks for watching

[@amitbahuguna3270]

Please send ppt which i have requested many times

[@ConceptsWork]

Our sincere apology for delay in response, we have responded to your request, please give us 24 hrs of time to respond. Thanks once again.

[@nambir]

Hi Sir, Whats the difference between OAUTH and SAML? when we have to use which. Any advantages one over the other?

[@ConceptsWork]

Oauth is an authorization protocol, where as SAML is signing protocol. There is a playlist for protocols as well. kzbin.info/aero/PL8wOlV8Hv3o_E60qM5121we8Os785AfKo

[@nambir]

@@ConceptsWork Thanks sir. i have seen WS Fed and SAML videos. Seeing openId connect in the playlist. we can achieve all types in OpenIDConnect +OAUTH, but why we need SAML.

[@neilruston8796]

OAuth is a standard or a framework but not a protocol.

[@ConceptsWork]

Please read the first line of this webpage. oauth.net/2/ OAuth 2.0 is the industry-standard protocol for authorization. Also, thank you so much for listening our videos so precisely.

[@neilruston8796]

@@ConceptsWork tools.ietf.org/html/rfc6749 defines it as a framework. #semantics :)

[@ConceptsWork]

Hello Neil, Thank you so much for bringing this up. These RFC's are published as a standards, in the same link read section 1.2 tools.ietf.org/html/rfc6749#section-1.2 (1.2. Protocol Flow) Also it depends on different service provider, how they want to implement it. Thank you Once again for bringing this up, much appreciated. "The OAuth 2.0 protocol is not backward compatible with OAuth 1.0. The two versions may co-exist on the network, and implementations may choose to support both. However, it is the intention of this specification that new implementations support OAuth 2.0 as specified in this document and that OAuth 1.0 is used only to support existing deployments." Some of the vendors which are developing as per them. auth0.com/docs/protocols/oauth2 OAuth 2.0 is a protocol that allows a user to grant limited access to their resources on one site, to another site, without having to expose their credentials.

[@abhimanyusinghshekhawat6871]

Can we call it as pseudo authentication protocol?.. I mean it's a standard for delegation which provide Authorization

[@krzysztofm5822]

Thanks!