Okay, so now with the basic registration all done, so now Mr. Ideas will
log in to the MovieEditor application and say, hey, I want to work on my movie.
Can you go and please get all my movies?
So at this point, the MovieEditor Web Application will say,
okay, do you have an account with us?
Do you want to log in?
Or do you want to use Movie Service Login?
The integrated OAuth service basically here.
And this is, think of this as a button or a link.
So when you click on this, what happens is now the movie service will
send the app ID that we got, or the client ID that we got in the previous step.
And it will send the redirect URI and
also the scope, which is like in this example here.
I want to create a movie and could be other edit option, delete option.
Other things could potentially be here as well.
Now, at this pont, the movie service will ask the user, hey,
we have a request from this movie service application.
The movie editor application.
Would you like to authorize this request or deny the request?
Also as part of this pop up or this message box,
which I don't have the entire thing here, but basically to say do you want to
authorize application to create movies, delete movies, post movies.
It will give you the list of stuff, it's a Facebook or a linkden or any of
those it will say do you want to share pictures, or do you want to share tweets.
So, it will give you a profile of the combinations that the user had or
rather, the application has basically asked.
So, in this example, it's Create Movies, or Edit Movies, or Delete Movies.
SImilarly, it could be sharing pictures, or tweets, or any number of combinations.
Based on that, the user can take an action as to authorize or deny the request.
So, once the user says, yep, I authorize this request,
what happens is, the movie service will now send back a code.
Now very important, this code is temporary and it's one time use only, so
it has a very short life meaning you have to the editor application or
the consumer application will have to go back with the code.
And then get a token back.
And again it's a one time use only.
So what happens next is the editor application will take that code,
using the app ID, and
the secret ID will quick, will go back to the movie service application.
And then, in return, if everything checks out and if everything is valid,
the then movie service will basically come back and give an access token.
This is the token very important that'll replace your credentials, your login and
password.
So any kind of action that was authorized like editing a movie, deleting a movie,
updating a movie, all those actions from the MovieEditor Web Application will
have to be done by attaching or sending the access token in every single request.
Now here is the same example in a little more technical here compared to
the previous chart.
So as you can see, and this is pretty much our demo and
we will go through every single step here.
So here, step A that we talked about the prerequisite step where the admin would
actually registered the application with the app name and the callback URL.
And then the service, the OAuth service,
will come back with AppRegistration information like provider name URL,
call back URL, app id and secret which you kind of store this information.
So when the user comes in, step 1, hey, can I access the movies for me,
can you get the movies for me so that I want to make some edits?
And the movie editor application will say, sure,
I'll build a authorization URL I will do this in the example using an OAuth 2 gem.
And it'll build a URL and will redirect to the provider site like Facebook or
in our example the Movie Service.
And it'll also give them information like, hey, where is the call back?
How do you, once the authorization is done,
where does this application need to come back?
What is the scope?
Whether it's editing or create movies in this example response type.
And this information will be sent across.
And then the authorization and the log in will happen between the user and
the service, whether it shall get Facebook or Movie Service in this example.
Now once all that is done, and authorization is done, the movie service,
based on this information of redirect and call back and scope and all that.
It will go back to the movie editor application here saying,
oh I got all the authorization, you're good to go.
Here is the callback question mark
code equal to some number one two three in this little example.
Using that code step seven you will go and get a token and
that token is very important because any edits or any postings or whatever
operation that you want to support from this application directly to the service.
You will be doing that http call,
that web service call, and you'll be sending access token equal to.
That's the only way that a service will know actually what's going on,
based on this access token.
So there's no more login and password.
It's all driven by this access token.
So it's secure, and the transaction is all done using this token.
