oauth2-authz-flow

name	oauth2-authz-flow
description	Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token
domain	cybersecurity
subdomain	identity-access-management
tags	["iam","identity","access-control","authentication","authorization","oauth2","oidc","pkce"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"]

Configuring OAuth 2.0 Authorization Flow

Overview

Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token lifecycle management, scope design, and alignment with OAuth 2.1 security requirements.

When to Use

• When deploying or configuring configuring oauth2 authorization flow capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Familiarity with identity access management concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Implement Authorization Code flow with PKCE for public and confidential clients
• Configure Client Credentials flow for machine-to-machine communication
• Design least-privilege scope hierarchies
• Implement secure token storage, refresh, and revocation
• Apply OAuth 2.1 best practices and RFC 9700 security recommendations
• Validate token integrity and prevent common OAuth attacks

Key Concepts

OAuth 2.0 Grant Types

1. Authorization Code + PKCE: Recommended for all client types (web, mobile, SPA). PKCE is mandatory in OAuth 2.1.
2. Client Credentials: Machine-to-machine authentication without user context.
3. Device Authorization Grant (RFC 8628): For input-constrained devices (smart TVs, CLI tools).
4. Refresh Token: Long-lived token to obtain new access tokens without re-authentication.

PKCE (Proof Key for Code Exchange)

PKCE (RFC 7636) prevents authorization code interception attacks:

1. Client generates random code_verifier (43-128 characters, unreserved URI chars)
2. Client computes code_challenge = BASE64URL(SHA256(code_verifier))
3. Authorization request includes code_challenge and code_challenge_method=S256
4. Token request includes original code_verifier
5. Server validates SHA256(code_verifier) matches stored