Single-use authorization codes in self-contained format
The present disclosure relates to computer-implemented methods, software, and systems for generating access tokens at an authentication server based on authorization codes. A first authorization server from a set of authorization servers receives a request for authorization of a request to access a resource by a resource owner. The first authorization server validates the request for authorization of the request to generate an authorization code. In response to successful validation of the request for authorization to generate the authorization code, the first authorization server generates a single-use authorization code by signing the generated authorization code with a unique private key. A unique public key is maintained for verifying the signed authorization code. The single-use authorization code is generated in a self-contained format. The single-use authorization code is provided to the client application for generation of an access token by one of the authorization servers from the set of authorization servers.
1. A computer implemented method for generating authorization codes at a set of authorization servers, wherein the set of authorization servers are organized to process requests for accessing resources and generate access tokens according to a non-consensual organization, where each authorization server is assigned the same right and role, the method comprising:
receiving, from a client application and at a second authorization server, a request including an authorization code for requesting access to a resource by a client application, wherein the authorization code is signed with a signature that is generated based on a private key generated at a first authorization server of the set of authorization servers, wherein each authorization server of the set of authorization servers is configured to generate and maintain a respective pair of a public key and a private key;
in response to receiving the request, generating, at the second authorization server, an access token based on verifying the signature of the authorization code, wherein verifying the access token comprises:
querying other authorization servers of the set of authorization servers to determine that the first authorization server had signed the authorization code; and
fetching a generated public key maintained at the first authorization server to verify the signature of the authorization code; and
providing the access token to the client application to access the resource.
2. The method of claim 1 , wherein the first authorization server generates the private key and the corresponding public key that are maintained in-memory at the first authorization server.
3. The method of claim 1 , comprising:
in response to fetching the public key, sending an instruction from the second authorization server to the first authorization server to delete the public key and the private key as maintained at the first authorization server.
4. The method of claim 1 , comprising:
in response to providing the public key to the second authorization server, automatically determining by the first authorization server to delete the public key and the private key.
5. The method of claim 1 , wherein providing the access token comprises:
in response to receiving the access token generation request and obtaining the public key at the second authorization server, generating the access token to be provided to the client application.
6. The method of claim 1 , wherein the authorization code is generated as a single-use authorization code by signing the generated authorization code with a unique private key as the private key, and wherein the public key used for verifying the authorization code is an unique public key maintained for verifying the signed authorization code at the first authorization server.
7. The method of claim 1 , wherein the authorization code is used as a single-use authorization code generated in a self-contained format.
8. The method of claim 1 , comprising:
generating, at the first authorization server, a unique key pair including the public key as a unique public key and the private key as a unique private key, wherein the unique key pair is generated in association with the authorization code.
9. A non-transitory, computer-readable medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations, the operations comprising:
receiving, from a client application and at a second authorization server, a request including an authorization code for requesting access to a resource by a client application, wherein the authorization code is signed with a signature that is generated based on a private key generated at a first authorization server of a set of authorization servers, wherein each authorization server of the set of authorization servers is configured to generate and maintain a respective pair of a public key and a private key, wherein the set of authorization servers are organized to process requests for accessing resources and generate access tokens according to a non-consensual organization, where each authorization server is assigned the same right and role;
in response to receiving the request, generating, at the second authorization server, an access token based on verifying the signature of the authorization code, wherein verifying the access token comprises:
querying other authorization servers of the set of authorization servers to determine that the first authorization server had signed the authorization code; and
fetching a generated public key maintained at the first authorization server to verify the signature of the authorization code; and
providing the access token to the client application to access the resource.
10. The computer-readable medium of claim 9 , wherein the first authorization server generates the private key and the corresponding public key that are maintained in-memory at the first authorization server.
11. The computer-readable medium of claim 9 , wherein the operations further comprise:
in response to fetching the public key, sending an instruction from the second authorization server to the first authorization server to delete the public key and the private key as maintained at the first authorization server.
12. The computer-readable medium of claim 9 , wherein providing the access token further comprise:
in response to providing the public key to the second authorization server, automatically determining by the first authorization server to delete the public key and the private key.
13. A system comprising:
a computing device; and
a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations, the operations comprising:
receiving, from a client application and at a second authorization server, a request including an authorization code for requesting access to a resource by a client application, wherein the authorization code is signed with a signature that is generated based on a private key generated at a first authorization server of a set of authorization servers, wherein each authorization server of the set of authorization servers is configured to generate and maintain a respective pair of a public key and a private key, wherein the set of authorization servers are organized to process requests for accessing resources and generate access tokens according to a non-consensual organization, where each authorization server is assigned the same right and role;
in response to receiving the request, generating, at the second authorization server, an access token based on verifying the signature of the authorization code, wherein verifying the access token comprises:
querying other authorization servers of the set of authorization servers to determine that the first authorization server had signed the authorization code; and
fetching a generated public key maintained at the first authorization server to verify the signature of the authorization code; and
providing the access token to the client application to access the resource.
14. The system of claim 13 , wherein the first authorization server generates the private key and the corresponding public key that are maintained in-memory at the first authorization server.
15. The system of claim 13 , wherein the system further comprises instructions which when executed cause the computing device to perform operations comprising:
in response to fetching the public key, sending an instruction from the second authorization server to the first authorization server to delete the public key and the private key as maintained at the first authorization server.
16. The system of claim 13 , wherein providing the access token comprises:
in response to providing the public key to the second authorization server, automatically determining by the first authorization server to delete the public key and the private key.