DRAG DROP - Drag and drop the steps on the left into the order on the right for an end-user to access an OAuth2 protected resource using the 'Authorization Code Grant' flow. Select and Place:
I think this is correct (assuming you are logging into Spotify but using your Facebook account for authz):
1 End user initiates authentication with OAuth client (spotify)
2 OAuth client communicates with authz server (facebook) to display login UI
3 End user authenticates with the authz server (fb)
4 OAuth client receives an authz code (from fb)
5 OAuth client requests access token from authz server (fb)
6 OAuth client receives access token from authz server (from fb)
7 OAuth client requests a resource on the resource server (plays spotify playlist)
1. End-user initiates authentication OAuth client.
2. OAuth client communicates with AS to display login UI.
3. End-user authenticates with the AS.
4. OAuth client receives an authorization code.
5. OAuth client requests access token from AS.
6. OAuth client receives access token from AS.
7. OAuth client requests a resource on the AS.
1. End-user initiates authentication OAuth client.
2. OAuth client communicates with AS to display login UI.
3. OAuth client receives an authorization code.
4. OAuth client requests access token from AS.
5. End-user authenticates with the AS. .
6. OAuth client receives access token from AS.
7. OAuth client requests a resource on the AS.
I would like to correct my previous answer. After studying more, I believe the correct order should be:
1. End-user initiates authentication OAuth client.
2. OAuth client communicates with AS to display login UI.
3. End-user authenticates with the AS.
4. OAuth client receives an authorization code.
5. OAuth client requests access token from AS.
6. OAuth client receives access token from AS.
7. OAuth client requests a resource on the AS.
1. end-user initiates authentication OAuth client
2. OAuth client communicates with autorization server to display login UI
3. OAuth client receives an authorization code
4. The client request access token from authorization server
5. End-user authenticates with the authorization server
6. OAuth receives access token from authorization server.
7. OAuth client request a resource on the resource server.
Source: Cisco DEVCOR 350-901 Study Guide (2.5 Describe the steps in the OAuth2 three-legged
authorization code grant flow)
(A) The client then initiates the OAuth flow
by directing the resource owner’s browser to the authorization
server’s endpoint.
(B) In this step, the resource owner decides whether to grant the
requested access to the client application.
(C) If the resource owner grants access, the authorization server
redirects the user’s browser back to the client using the redirection
URI provided earlier (in the request or during client registration). The
redirection URI includes an authorization code and any local state
provided by the client earlier.
(D) The client exchanges the authorization code for the access token
by making a POST request to the authorization server’s token
(E) The authorization server authenticates the client, validates the
authorization code, and checks that the redirection URI matches the
one used in step (A). If the request is valid, the authorization server
responds with an access token.
(F) The client accesses protected resources, using the access token for
authentication with the resource server.
as you mentioned... "The authorization server authenticates the client", the question says "End-user authenticates with the authorization server", that is different and checking the answer flow, the End user is the "resource owner" in your point A and B, so the answer of python_tamer looks ok
upvoted 1 times
...
...
...
This section is not available anymore. Please use the main Exam Page.350-901 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
python_tamer
Highly Voted 1 year, 4 months agoTeringzooi
Most Recent 8 months, 4 weeks agoCiscoRider
1 year, 1 month agoCiscoRider
1 year agoferock
1 year, 1 month agoferock
1 year, 1 month agotestingrealname
1 year, 1 month ago