OAuth + OpenID + InfoCard

This is an imaginary use case to demonstrate how OAuth,OpenID and InfoCards fit together.

User logs into Facebook with his user credentials.



User wants to share images from Flickr with Facebook.



OAuth comes into act now.

Facebook requests Request_Token from Flickr to access user's photos on his behalf.



Since user has not authorized the request, Facebook gets unauthorized Request_Token from Flickr.



Now, Facebook will redirect the user to Flickr for authentication.

User presents his OpenID at Flickr to get authenticated.



Flickr redirects the user to his OpenID Provider for authentication - say myOpenID.



User authenticates at the myOpenID with a registered Information Card.



On successfull login user is redirected back to Flickr.



Now, Flickr will ask the user - whether its okay to give Facebook the access to his photos - and once selected 'yes' - user will be redirected back to Facebook.

Now, Facebook will request an Access Token from Flickr.



Since the user has authorized - Flickr will grant the access token to Facebook.



Now, Facebook can access Flickr to get photos on behalf of the user.



Let me summarize what each technology is for.

OAuth - a machine authorisation protocol - gives permission for a system to access your account.

OpenID - provides decentralized single sign on.

InfoCards - provides phishing resistant authentication.