What is OAuth 2.0?

Short answer

OAuth 2.0 is the authorization framework with which the user gives an application limited access permission on the user's behalf without sharing the password (RFC 6749); it is the basis of "Sign in with Google" type flows. In the authorization code flow, the user is redirected to the provider's authorization page and logs in and gives consent there; the application exchanges the authorization code it receives on return for an access token at the provider's token endpoint. In TR7 AGS, the OAuth2-type Authentication Provider runs this flow and reads the user information from the provider's user info endpoint with the access token it received; the password never comes to TR7. In the OAuth Provider field, built-in providers such as e-Devlet, Google, Microsoft, GitHub, GitLab, Keycloak and Okta, or the Custom Provider whose addresses are entered manually, are selected. If the provider supports OpenID Connect, the OpenID Connect type, which reads the identity from the signed ID token, is preferred.

Where It Is Used in TR7

Where	Field / label	What for
AGS → Authentication → Authentication Providers	Provider Type = OAuth2; OAuth Provider (built-in provider or Custom Provider)	Login with an external provider
Same form (Custom Provider)	Authorization URL, Token URL, User Info URL, Fetch Endpoints from Issuer	The provider's endpoints; for built-in providers, they come from the catalog
Same form	Client ID, Client Secret, OAuth Scopes, Redirect URI	The details of the application registration at the provider
Same form (Custom Provider)	Client Authentication, Enable PKCE, User Info Request Method	The format of the token and user info requests
Same form	Revoke Tokens on Logout, Sign Out from Provider on Logout	Revoking the tokens and closing the session at the provider on logout
AGS-enabled vService → Flowchart	Authentication Provider step	Adding the OAuth2 provider to the access flow

How Does It Work?

1. The user comes to the AGS-enabled vService; the OAuth2 step in the flow redirects the user to the provider's Authorization URL address.
2. The user logs in at the provider and gives consent to the requested scopes.
3. The provider sends the user back to the Redirect URI address with an authorization code.
4. TR7 exchanges the code for an access token at the Token URL with the Client ID and Client Secret.
5. TR7 reads the user information from the User Info URL with the access token; the information is written to the session and the flow continues.

Common Misconceptions

• "OAuth 2.0 is an authentication protocol." OAuth 2.0 is for delegating access permission; the user's identity is carried in a standard and signed form by OpenID Connect (What is OpenID Connect (OIDC)?).
• "In the OAuth flow, TR7 receives the user's password." The password is entered only on the provider's page; TR7 sees only the code and the token.
• "Selecting a built-in provider makes the application registration unnecessary." A built-in provider brings only the endpoint addresses and the defaults; for the Client ID and Client Secret, an application registration is still created at the provider, and the Redirect URI is written there.

How it is done in the documentation

• OAuth2 · What Is OAuth2?
• OAuth2 · Built-in OAuth Provider Catalog
• OAuth2 · Profile Add Form

Related questions

• What is OpenID Connect (OIDC)?
• What is the difference between an access token and an ID token?
• What are the client ID and client secret?
• What is an OAuth scope?