ISC 2 Credentials CISSP Question # 175 Topic 18 Discussion

OAuth 2.0 is an authorization framework that enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner or by allowing the third-party application to obtain access on its own behalf. The end user must provide an access token to the service provider, which is issued by an authorization server after the user grants permission to the third-party application. The access token represents the user’s identity and the scope of access granted by the user. The service provider can then use the access token to authenticate the user and provide the requested service. A username and password are not required by OAuth 2.0, as they are only used to authenticate the user to the authorization server, not the service provider. A username or a password alone are not sufficient to authenticate the user to the service provider, as they do not indicate the scope of access granted by the user. References: OAuth 2.0, CISSP All-in-One Exam Guide, Eighth Edition, Chapter 5: Identity and Access Management (IAM)