Technical background

Before diving deep into flows, it’s important to understand some basic concepts regarding the actors that participate in the authorization or authentication process. If you are familiar with other protocols, you will appreciate that the concept is not so different.

Let’s start with the basics by trying to understand what the actors, devices, and servers involved in an OAuth 2.0/OIDC flow are and what their role during the authentication and authorization process is.

These are the main parties involved in nearly all protocol exchanges. The following diagram summarizes all of them:

Figure 3.2 – OAuth/OIDC parties

The preceding diagram shows the typical parties involved in authorization/authentication flows. The following are descriptions of each of the roles reported in the diagram:

• Resource owner: This is the entity that allows access to the final resource (the resource server). If this entity is a human...