The Design And Implementation Of Cisco OAuth2 Authorization System Authorization Code Module

With the development of distributed web service and cloud computing growing rapidly, gradually penetrated into all walks of life. Application Programming Interface (API) is a key foundation of cloud technology. API as an external entity such as a web client, desktop applications and cloud services provide a unified interaction approach. More data transfer through the API. However, the current password anti-pattern (password anti-pattern) threatens API security and scalability. In the password anti-pattern, API need to collect and use the user’s password to obtain user information.The model should be relatively safe explicit authorization occurs at the site where site users rather than implicitly sent to external services. Because the authorization (and other authorized users may permit) occurs at the site where the user and the site where the user can also take a timely revocation of authorization.In this paper, we provide a REST style OAuth2 authorization system based on Restlet framework, as applied safely through API (usually a RESTful) to access a protected resource (usually, but not exclusively, a particular user’s identity information). In OAuth process, there are three major players. OAuth allows a client (need to obtain application information) sent a request to the API server resources (RS, holding the desired application information), so that RS will be able to verify that the information is sent from the client is indeed over. Client can get authenticate at RS by including the access token in the API message (before the authorized server to the client). In OAuth application scenarios, the acces through API can protect the user’s identity. This can be guaranteed because the client can get access token from the authorization server only if the user agree the client’s access to user data.OAuth2 authorization system provide an abstract, highly scalable, high-performance access authorization mechanism to Cisco’s Eagle platform, in which exist a variety of web services. So that calls between services can get the right control. Safety can be provided by authorization token between service calls.