So let's try to understand what is what to actually in this lecture so ought to transfer open outrage
and to indicate it's a version.
So before or too there is a what one or what simply, which has its own drawbacks due to that reason,
a new version, an upgraded version of what came with the title or two.
So it's a free and open to everyone which is built on IETF standards and licenses from Open Web Foundation.
That means it's an open source framework.
Anyone can understand it and adopt it.
And there are many organizations in industry which follow or to a framework like Twitter, GitHub,
Facebook, Google.
So everyone uses what a framework to what is the reason why, what the framework is so famous and everyone
is adopting.
The reason is what the framework is a delegation protocol.
That means it will delegate the authentication and authorization of the user to something else so that
we don't have to take both authentication and authorization with the business logic that we maintain.
So I understand in simple terms, let's try to take two examples that we discussed.
One is an easy bank application where we have three different applications for loans, cards and accounts.
So instead of maintaining the authentication on the traditional logic in all these three applications,
I can have a single authorization server which handles violating the user credentials and issuing the
tokens.
So what will happen is all these three applications where now some user trying to get his launch details
are card details.
It will ask, do we have a token from The Observer?
If not, it will redirect to The Observer to log in there and get the token.
Then only I can provide you the particular resource.
But consider that the scenario where we have third party applications involved, like Twitter and Lazarre
app, where it can allow to analyze my tweets that I made inside the Twitter.
So in this scenario, I don't have to really expose my credentials to it unless it.
So whenever I want to login in the street, unless Lazarre app, it will delegate that login functionality
to Twitter by saying, OK, this user is a Twitter user.
I don't want to take his credentials to perform authentication or an operation.
I will redirect to Twitter alteration server where he can enter his world credentials and I'll get a
token from the Twitter, which I can use for all further communications to get the resources about the
user.
So this is one of the other scenario.
So basically you can think or two will allow you to decouple your authentication and authorization flow
to another server cauterization server, and at the same time, it will encourage you to maintain all
your protected resources separately, like my accounts, my loans, my cards inside a separate server
called Resolve.
So which means we are clearly drawing a boundary between authentication and actual protected resources
that server can take of authentication and authorization, whereas the resource server will hold the
resources.
And if someone has to give the resources, it will ask for the tokens from the Utsav.
If the token is valid, then only it will give the resources that users are requesting.
And the other user what, two years?
If we are interacting with third party applications like in many websites you might have seen, like
if you want to sign up very first time, you don't have to enter your last name, first name, email,
mobile, because there are faster ways to achieve that by using Google, GitHub, Twitter, Facebook,
because already these organizations have a basic information about me, like what is my last name,
what is my first name, what is my email?
So instead of entering all those credentials again in the new application that I want to sign up, what
I can do is I can tell the new application.
I have my protected resources inside Facebook, like my last name, first name, Umit, go and get from
the Facebook.
So as soon as a user click on the Facebook login inside that application, that application will redirect
to Facebook login page where I can enter my credentials.
Once my authentication is successful, Facebook will share a token to this new application to get basic
details about me so that the registration form will be fast and efficient.
So these are the most common users of adopting the water framework.
In many ways you can think what to talk on the token that is issued by the alteration somewhere inside
what the framework is like a temporary access card.
So instead of providing the credentials again and again, this temporary access token will help me.
Will help the third party APIs to access my protected resources, and we know that expenditures are
now someone invalidate my access token inside that.
So definitely I have to read log again.
So instead of sharing your actual credentials like Moustaki, I will get a temporary access card, which
we call it as Access Grogan's inside what framework?
So now we have a basic understanding of what we do to in the next lecture we will try to understand
what are the different components involved inside the TO framework to clear our understanding even more
further.
So don't worry if you're not clear what I'm saying now about auto, because in the coming lectures you
will get more clear understanding about it.
Thank you.
And see you in the next lecture by.