From my talk @ Flash Camp India conducted at MGR University, Chennai - India. #indifc www.indiflashcamp.com

1. @udayms Enter the
world of
acrossthinlines.com
0Auth & AIR
Flash Camp India 2010
Chennai, India
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
1

2. • UX/UI Evangelist
• Owns Prototyping @ Yahoo! India
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
2

3. In the Beginning
API.execute(userName, passWord);
Or in other words…
API.execute(“give me ur life”);
// and trust me to not use it or sell it later so that someone else can
F&*$K you completely!
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
3

4. PLAXO
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
4

5. This even used to have a name!!
Password
Anti-Pattern
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
5

6. December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
6

7. OAuth
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
7

8. Like a
VALET KEY
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
8

9. OAuth
Google AuthSub + aol
OpenAuth + Yahoo BBAuth +
Upcoming api + Flickr api +
Amazon Web Services api +
others
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
9

10. Is…
Open, generic
Standard for
API access
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
10

11. Is…
authorization
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
11

12. Is…
not
(authentication)
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
12

13. How did it
start? Blain Cook,
& Others
start looking at
OpenId for API Services
They realize a need for a
solution & start working on it
Dewitt Clinton from Google
begins supporting the effort
Oauth core draft 1.0 released.
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
13

14. Why?
“…these days, everyone wants to build an App
Store. Because every access key is a license that
you can turn on and off, OAuth makes it easier
for your integrations to generate revenue, and
that means more and better integrations…”
-Sunir Shah (FreshBooks)
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
14

15. December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
15

16. December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
16

17. December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
17

18. Service Provider provides your app with Keys & Secrets to uniquely
identify it.
Your users who already have an account with Service Provider.
They will approve your application’s request for information.
Your application that is registered with your service provider and
used by your users. Your application also stored your credentials
internally.
Your Oauth layer
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
18

19. First Handshake
Your Application
Service Provider
Your Users
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
19

20. Next time…
Service Provider Your Application Your Users
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
20

21. Your Application
Facebook
OAuth
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
21

22. Dude…
My
user
wants
Sure.
Send
him
along.
access
to
his
stuff
on
Btw,
I
only
speak
Oauth.
your
server.
Your Application
Facebook
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
22

23. Your Application
Facebook
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
23

24. What’s
your
Pasword?
PASSWORD1234@34
Your Application
Facebook
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
24

25. Gr8!
Here’s
your
token!
Your Application
Facebook
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
25

26. Perfect!
Your Application
Facebook
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
26

27. Dude!!
Here’s
my
user’s
credenVals,
Sure.
Here
you
go!!!
give
me
stuff!
Your Application
Facebook
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
27

28. December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
28

29. December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
29

30. December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
30

31. December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
31

32. December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
32

33. December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
33

34. December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
34

35. Code Ranger OAuth Library
http://www.coderanger.com/blog/?p=59
as3corelib
https://github.com/mikechambers/as3corelib
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
35

36. Twitter @udayms
Blog acrossthinlines.com
LinkedIn linkedin.com/in/udayms
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
36

37. Sources I ripped off from…
• Slideshare: factoryjoe/oauth-ftw-presentation
• Slideshare: kellan/advanced-oauth-wrangling
• Slideshare: mbleigh/the-present-future-of-oauth
• http://dev.twitter.com/pages/auth
• Google Images
• Flickr
• Oauth.net
December
12,
2010
acrossthinlines.com
|
@udayms
|
linkedin.com/in/udayms
37