Authentication and Authorization are two big concepts that are required for almost every application. <\/p>\n\n\n\n
Authentication deals with verifying who the current user is and whether or not that user is currently present. For example, when Bob Smith logs into an application (i.e. Facebook), the application needs to know that the user is \"Bob Smith\" in order to show Bob his personal content that only he should see. The app also needs to verify that Bob actually is present and that the person trying to access the account within the app is not someone or something else trying to get his information. (More info on OAuth.net<\/a>) <\/p>\n\n\n\n Authorization deals with whether or not an application can access a particular piece of a user's online belongings, called \"Resources\", such as information, pictures, videos, and documents. For example, say you download a voice recording app on your iphone and the app wants to push your recording to your Dropbox or Google Drive. Or maybe it wants to post to your Facebook timeline. The app needs permission to access those other resources that you own on other applications. (More info on OAuth.net<\/a>)<\/p>\n\n\n\n OAuth 2.0 is a specification that specifies how to perform the latter Authorization process so that developers can learn one way of doing Authorization and apply it to all their applications. Before OAuth 2.0 if a developer wanted to program the application to access a 3rd party system, like Google Drive, Dropbox, or Facebook, the developer might have to learn three different ways<\/em> of interacting with those other applications, which adds unnecessary complexity and ultimately unnecessary cost to their product.<\/p>\n\n\n\n Many services like Auth0<\/a>, Okta<\/a>, and IdentityServer<\/a> have sprung up that help a developer more easily implement OAuth 2.0 (along with the current most popular associated Authentication protocol OpenID<\/a>) without having to dig deep into learning the actual Authentication and Authorization protocols themselves. <\/p>\n\n\n\n In order to implement those helpful near plug-and-play services, however, a developer still needs to learn the basics of the protocol so as to properly configure the service. And because of the strange history in the uprise of these types of protocols, there can be some conflicting information about how to properly implement the protocol. That's when its time to head to the source documentation.<\/p>\n\n\n\n