OAuth - What exactly is a resource owner? When is it not an end-user?

oauth oauth-2.0 oauth-provider
smartcaveman picture smartcaveman · Jun 7, 2011 · Viewed 17.3k times · Source

The term "resource owner" is defined in the OAuth v2.0 Specification, as "An entity capable of granting access to a protected resource. When the resource owner is a person, it is referred to as an end-user."

My question is, when is a resource owner not an end-user? I would appreciate explanation through examples that could be real use cases. For example, if the protected resource is a Facebook user's photo, is the resource owner Facebook or the Facebook user who uploaded the photo? Also, why is the resource owner (that is also a person) be considered an end-user if that person is not even a user of the application that is implementing OAuth? And, if the Facebook user is the resource owner, then what role does Facebook play in this exchange?

Answer

Eran Hammer picture Eran Hammer · Jun 21, 2011

Resource owner can be a machine, not just people. There are many cases where no humans are involved in the entire OAuth flow, especially in enterprise setups. At least, that's what I meant when I introduced the term in RFC 5849 (and later in OAuth 2.0).

Related questions

Is it possible to secure WebSocket APIs with OAuth 2.0?

I am implementing an OAuth Provider to secure different web-based APIs. The most headache is giving me the securing of WebSockets through OAuth. Can it be done completely secure in a client that's set in a Browser? What are the …

Read More
OAuth2.0 Server stack how to use state to prevent CSRF? for draft2.0 v20

I am using PHP library for OAuth2.0 v20 In draft20, there is a mention of the use of state to prevent CSRF So far, my own web app that implements this PHP library allows the following: 3 legged authentication using Authorization …

Read More
What are the main differences between JWT and OAuth authentication?

I have a new SPA with a stateless authentication model using JWT. I am often asked to refer OAuth for authentication flows like asking me to send 'Bearer tokens' for every request instead of a simple token header but I …

Read More