What are the 4 core roles in the OAuth 2.0 Framework (RFC 6749)?
❓ Interview Prompt: Explain Resource Owner, Client, Authorization Server, and Resource Server roles in OAuth 2.0.
The OAuth 2.0 Authorization Framework (RFC 6749) defines 4 primary roles to enable third-party applications to obtain limited access to an HTTP service:
1. Resource Owner (User):
The end user who owns the account data and grants access to their resources (e.g. your Google account owner).
2. Client (Application):
The third-party application requesting access to the resource owner's account (e.g. a Mobile App or Web App).
3. Authorization Server (Identity Provider):
The server that authenticates the Resource Owner, requests consent, and issues access tokens upon success (e.g. 'accounts.google.com').
4. Resource Server (API Gateway):
The API server hosting protected user resources that accepts and validates OAuth 2.0 access tokens (e.g. 'google.googleapis.com/drive/v3').
Code Implementation Example
{
"oauth2_topology": {
"resource_owner": "Alice (User)",
"client": "Spotify Web App",
"authorization_server": "https://accounts.spotify.com",
"resource_server": "https://api.spotify.com/v1/playlists"
}
}OAuth 2.0 divides responsibilities across 4 roles: Resource Owner (User), Client (App), Auth Server (IdP), and Resource Server (API).