Take control of your APIs and get a free t-shirt when you complete the 3step Challenge, brought to you in partnership with 3scale.
I had the pleasure of discussing REST access control patterns with Enterprise Architects and partnering technology folks a while back. I also had the opportunity to present on this topic
and one of the questions that came up afterwards was from a security architect who was unsure whether OAuth would be a good fit for some existing APIs that they have because those APIs happen to be consumed from two very different sources:
- From the inside, by internal applications that do not act on behalf of a particular subscriber but from the provider’s perspective
- From the outside, by applications that act on behalf of individual subscribers
OAuth 2.0 provides 4 core grant types that address different situations. In the case of the example described above, you could use the client creds grant type for the first type of access. It should be possible to permit different scopes to different client ids. The internal client ids would be allowed to request wider scopes. For the second type of consumption, the external one, any of the other 3 grant types could be applicable.
Hope to see you at RSA next year.
The Integration Zone is brought to you in partnership with 3scale. Learn how API providers have changed the way we think about integration in The Platform Vision of API Giants.
Published at DZone with permission of
, DZone MVB
Opinions expressed by DZone contributors are their own.