OAuth can be defined as delegation or authorization protocol.
The resource owner who owns the resource is allowing an application to access that resource on their behalf without impersonating the resource owner.
The application first requests for the authorization from the resource owner and receives the token using which it can access the resource.
Here the token specifies the delegated rights that the client application will have.
Below are the main components that are involved in OAuth.
|
Resource Owner |
In most of the cases it is the user who has access and can delegate access to the Web API. In Dynamics CRM context it can be the CRM User. |
|
Protected Resource |
Web API of Dynamics 365 CE |
|
Authorization Server |
Trusted by protected resource (Dynamics CRM) to issue Access Tokens to Clients, which the client can then use to access protected resource (Web API). Azure Active Directory (Azure AD) in this case. Resource Owner authenticates to the Authorization server, so the credentials are not exposed to the client. |
|
Client |
3rd party application that wants to use the Dynamics 365 Web API on behalf of the Resource Owner (CRM User). |
There are several different kinds of grant type or flow that exist in OAuth for getting the access token.
-
OAuth 2.0 Authorization Grant Type
The below image wonderfully explains it in the context of Dynamic 365 Customer Engagement.
-
The resource owner (CRM User) opens the Client Application in the User Agent (Browser)
-
Client Application asks the resource owner to authorize at the authorization server.
-
Resource Owner authenticates and grants authorization to the Client. Authorization server gives authorization code to the Client.
-
Client uses this authorization code along with its own credentials to request access token from authorization server.
-
Client receives the access token that it uses to use the protected resource i.e. Web API.
As the user’s authenticates using his credentials with the authorization server, this information is not accessible to the client application, thus protecting user from sharing the credentials with the Client Application. Along with Access Token, we have Scope in OAuth 2.0 basically set of rights for the protected resource, which provides the mechanism for limiting the access granted to the client application. Also Refresh Token which is to be used when the access token has expired or stopped working. Client asks for the Refresh token from the Authorization Server and then uses this new token to access the protected resource.
Check out the below blog post for further details
-
Implicit Grant Type
Implicit Grant Type is for the client applications that can’t keep any secrets from the browser, a JavaScript Application running completely inside the browser. So instead of authorization code, in implicit grant, the authorization server returns the access token.
Few limitations of this flow are first it can’t keep the secret as it will be available to the browser, also this flow cannot be used to get the refresh token as the session is limited to the browser context.
-
The client sends the request with request_type as token (instead of code in case of Authorization Grant) to the Authorization Endpoint of the Authorization Server.
-
The resource owner authenticates and authorizes the client.
-
The authorization server generates the token, attaching it to URI fragment of the response.
-
Client Credentials Grant Type
Client Credentials Grant Type is for scenario when we do not have any explicit resource owner (or user) like a back-end system or CRON job running on the server. As there is no user involved to delegate the authorization, client acts as the resource owner.
-
The client application requests the access token directly from the token endpoint of the Authorization Server with grant_type as client_credentials.
-
The authorization server issues the access token to the client.
-
Resource owner credentials grant type
-
The client application prompts Resource Owner for username and password.
-
Client application uses this information to request access token (with grant_type as password) from the Token Endpoint of the Authorization Server.
Here the disadvantages are that the credentials are exposed to the client application, and also the same is passed in plain text to the authorization server. This grant type is only recommended to be used for the legacy applications to bring them into the OAuth world, wherein they can work with access token, scopes etc. One good thing about this flow is that the password is exchanged only first time when requesting the access tokens, instead of every request.
Decision Tree for the choosing the right grant type
Recommend read –
https://auth0.com/docs/api-auth/which-oauth-flow-to-use
https://debajmecrm.com/?s=oauth
Hope it helps..
Nishant Rana's Weblog 
8 thoughts on “OAuth 2.0 with Dynamics 365 CE Web API”