Mobile oauth service
A framework, which conforms to the OAuth standard, involves a generic OAuth authorization server that can be used by multiple resource servers in order to ensure that access to resources stored on those resource servers is limited to access to which the resource owner consents. Each resource server registers, with the OAuth authorization server, metadata for that resource server, indicating scopes that are recognized by the resource server. The OAuth authorization server refers to this metadata when requesting consent from a resource owner on behalf of a client application, so that the consent will be of an appropriate scope. The OAuth authorization server refers to this metadata when constructing an access token to provide to the client application for use in accessing the resources on the resource server. The OAuth authorization server uses this metadata to map issued access tokens to the scopes to which those access tokens grant access.
1. A computer-implemented method comprising:
receiving, at an OAuth authorization server, from a first application executing on a first mobile device, a first registration request for access by multiple applications on the first mobile device, wherein the first registration request includes a first device token that is previously received by the first application from a server computer that provides a service, wherein the first device token includes an identity of the first application that the service uses to identify the first application, and wherein the server computer is different from the OAuth authorization server;
in response to receiving the first registration request, the OAuth authorization server generating a first client registration token for the first application;
splitting the first client registration token into a first part and a second part;
encrypting the first part of the first client registration token and the second part of the first client registration token;
sending, from the OAuth authorization server, to the server computer that provides the service, the first device token and a notification specifying the first part of the first client registration token; and
sending, from the OAuth authorization server, the second part of the first client registration token to the first mobile device through a communication channel that is unrelated to the service.
2. The computer-implemented method of claim 1 , wherein the service is an Apple Push Notification Service (APNS); wherein the first application received the first device token from the APNS as part of a registration process in which the first application engaged with the APNS; and wherein the APNS uses the first device token to push notifications to the first application.
3. The computer-implemented method of claim 1 , wherein the service is a Google Cloud Messaging (GCM) service, and wherein the first application received the first device token from the GCM service as part of a registration process in which the first application engaged with the GCM service; and wherein the GCM service uses the first device token to send messages to the first application.
4. The computer-implemented method of claim 1 , wherein the communication channel is a Hypertext Transfer Protocol (HTTP) channel through which the OAuth authorization server received the first registration request from the first mobile device.
5. The computer-implemented method of claim 1 , further comprising:
receiving, at an OAuth authorization server, from a second application executing on a second mobile device, a second registration request for access by multiple applications on the second mobile device, wherein the second registration request includes a second device token that is previously received by the second application from a server computer that provides a service, wherein the second device token includes an identity of the second application that the service uses to identify the second application, and wherein the server computer is different from the OAuth authorization server;
in response to receiving the second registration request, the OAuth authorization server generating a second client registration token for the first application;
splitting the second client registration token into a first part and a second part;
encrypting the first part of the second client registration token and the second part of the second client registration token;
sending, from the OAuth authorization server, to the server computer that provides the service, the second device token and a notification specifying the first part of the second client registration token; and
sending, from the OAuth authorization server, the second part of the second client registration token to the second mobile device through a communication channel that is unrelated to the service;
wherein the second device token differs from the first device token.
6. A non-transitory computer-readable storage media comprising instructions which, when executed by one or more processors, cause the one or more processors to perform:
receiving, at an OAuth authorization server, from a first application executing on a first mobile device, a first registration request for access by multiple applications on the first mobile device, wherein the first registration request includes a first device token that is previously received by the first application from a server computer that provides a service, wherein the first device token includes an identity of the first application that the service uses to identify the first application, and wherein the server computer is different from the OAuth authorization server;
in response to receiving the first registration request, the OAuth authorization server generating a first client registration token for the first application;
splitting the first client registration token into a first part and a second part;
encrypting the first part of the first client registration token and the second part of the first client registration token;
sending, from the OAuth authorization server, to the server computer that provides the service, the first device token and a notification specifying the first part of the first client registration token; and
sending, from the OAuth authorization server, the second part of the first client registration token to the first mobile device through a communication channel that is unrelated to the service.
7. The non-transitory computer-readable storage media of claim 6 , wherein the service is an Apple Push Notification Service (APNS); wherein the first application received the first device token from the APNS as part of a registration process in which the first application engaged with the APNS; and wherein the APNS uses the first device token to push notifications to the first application.
8. The non-transitory computer-readable storage media of claim 6 , wherein the service is a Google Cloud Messaging (GCM) service, and wherein the first application received the first device token from the GCM service as part of a registration process in which the first application engaged with the GCM service; and wherein the GCM service uses the first device token to send messages to the first application.
9. The non-transitory computer-readable storage media of claim 6 , wherein the communication channel is a Hypertext Transfer Protocol (HTTP) channel through which the OAuth authorization server received the first registration request from the first mobile device.
10. The non-transitory computer-readable storage media of claim 6 , further comprising:
receiving, at the OAuth authorization server, from a second application executing on a second mobile device, a second registration request that includes a second device token that is previously received by the second application from a server computer that provides the service, wherein the second device token includes an identity of the second application that the service uses to identify the second application;
in response to receiving the second registration request, the OAuth authorization server generating a second client registration token for the second application;
splitting the second client registration token into a first part and a second part; and
sending, from the OAuth authorization server, the second device token and the first part of the second client registration token to server computer that provides the service;
wherein the second device token differs from the first device token.
11. A system comprising:
a first mobile device that stores a first application; and
a machine that is separate from the first mobile device and that stores an OAuth authorization server that is configured to:
receive, from the first application, a first registration request for access by multiple applications on the first mobile device, wherein the first registration request includes a first device token that is previously received by the first application from a server computer that provides a service, wherein the first device token includes an identity of the first application that the service uses to identify the first application, and wherein the server computer is different from the OAuth authorization server;
generate a first client registration token for the first application in response to receiving the first registration request;
split the first client registration token into a first part and a second part;
encrypt the first part of the first client registration token and the second part of the first client registration token;
send to the server computer that provides the service, the first device token and a notification specifying the first part of the first client registration token; and
send the second part of the first client registration token to the first mobile device through a communication channel that is unrelated to the service.
12. The system of claim 11 , wherein the service is an Apple Push Notification Service (APNS); wherein the first application received the first device token from the APNS as part of a registration process in which the first application engaged with the APNS; and wherein the APNS uses the first device token to push notifications to the first application.
13. The system of claim 11 , wherein the service is a Google Cloud Messaging (GCM) service, and wherein the first application received the first device token from the GCM service as part of a registration process in which the first application engaged with the GCM service; and wherein the GCM service uses the first device token to send messages to the first application.
14. The system of claim 11 , wherein the communication channel is a Hypertext Transfer Protocol (HTTP) channel through which the OAuth authorization server received the first registration request from the first mobile device.
15. The system of claim 11 , further comprising:
a second mobile device that stores a second application and that is separate from the first mobile device; and wherein the OAuth authorization server is configured to:
receive, from the second application, a second registration request that includes a second device token that is previously received by the second application from a server computer that provides the service, wherein the second device token includes an identity of the second application that the service uses to identify the first application;
generate a second client registration token for the second application in response to receiving the second registration request;
split the second client registration token into a first part and a second part;
encrypt the first part of the second client registration token and the second part of the second client registration token;
send, to the server computer that provides the service, the second device token and a notification specifying the second client registration token; and
send the second part of the second client registration token to the second mobile device through a communication channel that is unrelated to the service;
wherein the second device token differs from the first device token.