In this election, let's try to understand what are the different components involved inside the auto
framework, like whenever someone want to adopt the auto framework.
So these are all the components which will be involved inside the authentication and authorization from
the very first one that we are discussing previously is the authorization so so attribution.
So is the one which is state isolator and responsible to validate user authentication and authorization,
postulating that it has to issue a token.
And this also is a server where all the protected resources of any user like my credit card details,
my account details will be stored inside a database which can be accessed by resource our only.
And this resource server will give the protected resource to someone only if they provide a valid token.
It will never ask you the user name and credentials.
It will always ask you the token and the same token.
The resource server will get violated with the attribution.
So in case there is no token available, it's the responsibility of the developer architects to detect
that and redirect to Ottawa to perform the logging operation.
And the third component is the resource.
Worner are the user we call it.
That's like if I am using a grid analyzer app, are easy bank application, I am the resource one.
I want the resources which are staying inside the database, like my account, my credit card details
are the tweets that I have made inside that Twitter application.
So those are the particular resources.
Since I want them, I will become the resource who are the user?
And the last component is the client.
So client is an application which you want to access the resources worn by a user on their behalf.
Like in the grid analyzer app.
The grid analyzer is the client.
I am the resource Warner and operations over and resource are what is the Twitter application.
So if you look at the sample or to flow in the output analyzer app, you can see the very first component
is that resource one are the user, which is me, who is trying to use that tweet analyzer app.
When I go to tweet analyzer app, like I want you to analyze my tweet, tweet analyzer app, which is
a client in this scenario, will ask me, okay, I will refer you to the Twitter authorization.
So you have to enter your credentials there to prove your identity.
And once your identity is approved, the Twitter authorization server will issue a token to me.
But in this scenario, the client will never ask that Twitter connections directly.
It will take you to the traditions of the Twitter.
So once a client receives the token, the same token, the tweet analyzer, which is client here, will
send to the resource server of the Twitter to get the resources like my tweets.
He tweets, how many likes I received commands all those resources from the resource.
So.
So in this flow, the resource server will validate the token issued by the observer is a valid or not
by connecting with the observer and we can see what are different ways to to establish a connection
between Ottawa and resource or in the coming lectures.
But now let's assume like every time you send a token to the resource so it will connect to the Observer
to validate it.
So in this way, all the components that involved in the auto flow will make or authentication and alteration
flow smooth.
And by following the industry standards, as you can see next time, if I go to the Twitter analyzer
app again, are making any actions in that tweet analyzer app application, it don't ask me credentials
again and again because I already gave my credentials to the Twitter attribution.
So I received a token.
The same token will be leveraged by the tweet unless that app.
And you can also see Twitter also decouple their authentication flow and business logic into two different
servers, which is automation software.
And also.
So let's try to go to any websites that we use on day to day basis and try to understand how this ought
to flow works by trying to login and signing up for the website.
For the same, I came to our most common favorite website of our for developers, which is Stack Overflow.
You can see here I just came to this website very first time and I never had a login into this application.
Obviously, if you login into this application or sign up into this application, you have advantage
like posting your.
Answers are liking someone, answers are posting questions, so all those extra features someone can
leverage in stack overflow only if there are going into this application.
So obviously when a click sign that you can see here, there are two ways.
One is the traditional way where I can enter my email password name and register myself post MasterCard
Flow will ask me to validate my email by sending a verification link.
But this is a time consuming it and it is an annoying process.
Instead, Stack Overflow also has options of getting my basic details about my name, email, and obviously
I don't have to store any password details with code flow because I always interact with the Google
argued.
How about Facebook?
So in this scenario I try to sign up using Google.
So as soon as I click sign up with Google, you can see the page has been redirected.
The stack overflow is never asking me to enter my credentials in their website because they're delegating
that authentication and authorization to actual vendor itself in this scenario, which is Google.
And you can also see it is following Watto and there is a claim to the purpose of client I.D. So in
this scenario, the client is Jackalope, the resource.
Worner Our user is me and the Observer and the resource server is the Google.
So whenever someone want to use the Google servers and it also wants to get the basic details, first,
they have to register themselves.
First Stack Overflow has to reach out to the Google developer community.
Ah, Google developer website restrict themselves where they'll get to claim Tildy and client secret,
which they can use all this water to fill due to this client.
You can see Google detected that I'm getting a request from stack up dot com.
So now I enter my Gmail here and Google is trying to asking me to prove my identity by logging into
my mobile and approving the authentication request.
I did it.
And you can see now the redirection will happen from Google to stack overflow.
Now, Stack Overflow has all the basic details about me, like what is my name, what is my email?
All those basic details it got from the Google Utsav this way, all the four components involved in
the auto flow will interact with each other to make a smooth and successful identification and operation
flow.
And based upon the scenario, how different flavors of what to flow like.
The flavor that rightnow we saw is one of the flavor.
But we have five different flavors where to will follow to issue a oaken and validate the tokens during
the authentication and authorization flow.
Depending on the scenario that you are into, you can leverage any of these flows and all these flows
have their own advantages and disadvantages.
And obviously you have to write them off to choose the most optimum one for your application.
PSINet, I hope now you have some clear understanding what is what to flow and what are different components
involved in.
The next lecture will look into the the most common grant type, which is authorization code.
Thank you.
And see you in the next video by.