Google I/O 2012 - OAuth 2.0 for Identity and Data Access

Ryan Boyd

Users like to keep their data in one place on the web where it's easily accessible. Whether it's YouTube videos, Google Drive files, Google contacts or one of many other types of data, users need a way to securely grant applications access to their data. OAuth is the key web standard for delegated data access and OAuth 2.0 is the next-generation version with additional security features.

This session will cover the latest advances in how OAuth can be used for data access, but will also dive into how you can lower the barrier to entry for your application by allowing users to login using their Google accounts. You will learn, through an example written in Python, how to use OAuth 2.0 to incorporate user identity into your web application. Best practices for desktop applications, mobile applications and server-to-server use cases will also be discussed.

[technics]

I like these google videos, but... they should MAKE SOME TUTORIALS. They show technology but if I want to use it - I have to read 100 help pages to learn this.

[aleksmarino]

Great seminar :) I finally understood something from this OAuth 2.0 :D Thank you

[ryguyrg]

@Enrique - SSL is required for transmission of the access tokens. This mitigates the risk of it being capture by a malicious proxy. SSL would also be used by any reasonable identity providers to protect the login screen.

OAuth does not protect users who are not taking standard security precautions (such as making sure the site they're entering the credentials into is valid)

[DzafarSadik]

Great talk, helped me a lot. Thank you :)

[kingsmobilemarketing]

Thanks for the updates... please keep them coming...

[bablubal]

great tutorial, help me a lot.... thanks.

[ChristophBackhaus]

can't wait for more sites to implement this

[tejedaAlex]

Are these tokens and codes universally unique, application id dependent? or are re-issued later? I guess the token/code seed isn't publicly available.

[jeevaengg]

very useful one for beginners to understand oauth 2

[nimeshchanchani]

I understand that using application login, we can get the user profile in my android application like email ID, Firstname and User ID, But what if I want to create an Application specific user profile for the user based on my application ? for E.G i want to know when the user logged into my application what products did he visit from my product catalogue. Does google have API's / Some place where I can store this info and retrieve it when needed or would I have to create my own data store in the cloud with the User-ID as the key? Whats the best design to accomplish this use case?

[jasonyardley]

do you have to have a redirect URL? im trying to use a client id and secret to get an access token which i can use to perform tasks in admin sdk (onboarding offboarding users). i can do this with refresh tokens via google playground but when i use my own client id and secret (which they have an option to use) it doesnt work... so i seem to be missing something but not sure what

[raduursariu]

How can users login on your site using data from another website. for example I have to create a website where student will login using data from our university site, I mean instead of "login with google" or "login with facebook" they can be able to "login with university-data".. How can I make this possible?

[bparanj]

I have a Web Service using Google Cloud Enpoints. How do I limit the API access only to my web application running on another domain? There is no user involved, this is a server to server authentication scenario. Which API should be used in this case?

[tcrizzy]

exactly my thoughts. i guess tokens, since they expire, limit the amount of time that damage can be done, other than that, i really don't see the point... and to add to the refresh token, what if that is exposed... then it's infinite...

[troooooper]

this speech didn't tell how auth 2.0 is better, improved, and works analytically. 

[ashishchaturvedi]

Hi, i am creating a mobile app backend in php .How can i use Oauth in it.

[MrSaboorgee]

Talking about OAuth 2.0 1:48 book name

[MrSaboorgee]

It is amazing :P now i can login with my yahoo account on facebook and with facebook account on yahoo. :P:P:P

[gcptrial]

Server to Server Authentication - 17:27

[ZFlyingVLover]

I hope this 'major' site changed their password storage scheme to a 1 way hash so they don't have to worry about having their passwords stolen cause they'll be encrypted anyway. no biggie.