用于REST Web服务的OAuth 2.0

Question

i'm implementing a REST layer for an existing application. I have my userid and passwords stored in database and i would like to authenticate these credentials while calling my REST services. Note that this is a standalone application.

After investigation, I figured out 2 ways.

• Basic implementation with HTTPS - this approach makes sure that userid and password passed is not tampered by Man in middle attack.
• Using Authentication Token(JWT) - user initially passes his userid and password and server gives back an Authentication token.Once user have an authentication token that could be used for subsequent request.
• Using OAuth 2.0 - I'm very confused in this approach. After reading the docs and specification, I found that since my application is standalone, I need to implement Authorization Server, Resource Server etc.

I'm asked to implement OAuth here, but i'm not convinced that OAuth is required in this scenario. I'm more inclined towards just implementing JWT(tokens)

Is OAuth really mandated in this scenario. What i understand about OAuth is it is used when you already have a service like Facebook/ Google.

Could someone pls confirm if my train of thoughts are correct and if OAuth 2.0 is required in this case?

Answer 1

The primary goal of OAuth 2.0 is to allow users to authenticate to use a client application via a third-party authentication provider (eg Google, Facebook, etc.), without exposing their credentials (typically a username/password) to the client.

In your case, if users are only ever going to authenticate to your system using their credentials in your database, then implementing OAuth 2.0 doesn't add any substantial value for you.

The OAuth 2.0 specification does define a "Resource Owner Password Credentials grant" , intended for legacy use cases, that would apply to your situation: a user sends credentials, and you return an access token (that could be a JWT, if you like). If it's desirable from a management or marketing perspective, you could implement the Resource Owner Password Credentials grant and legitimately state that your application "conforms to a subset of OAuth2, as defined by RFC6749".