Home > Glossary > Certified Information Systems Security Professional > OAuth 2.0

📖 What is OAuth 2.0?

OAuth 2.0 is an industry-standard authorization framework that enables a third-party application to obtain limited access to an HTTP service. It uses access tokens to delegate authority without requiring the user to share their credentials with the third-party app.

🥋 Sensei Says:

"Do not confuse this with SAML. OAuth is about granting a 'token' to an application to act on your behalf, not proving who you are."

📚 Certification: Certified Information Systems Security Professional (CISSP)

🔑 What are the Key Concepts of OAuth 2.0?

▸ OAuth 2.0 focuses on authorization, allowing a client application to access specific resources on behalf of a user without ever seeing the user's credentials.
▸ The framework utilizes access tokens, which are short-lived credentials that grant limited access to protected resources based on predefined permissions.
▸ Scopes are used to define the specific level of access requested by the application, ensuring the principle of least privilege is maintained during delegation.
▸ The four primary roles involved are the Resource Owner, the Client, the Resource Server, and the Authorization Server, each with distinct responsibilities.
▸ Grant types define the specific flow used to obtain a token, varying based on whether the client is a confidential server or a public app.

🎯 How does OAuth 2.0 appear on the CISSP Exam?

You may be asked to identify the correct framework for a scenario where a third-party application needs to post updates to a user's social media profile without storing the user's password.

A scenario might describe a need for delegated access to a cloud API. You must distinguish whether the requirement is for identity verification (SAML/OIDC) or resource authorization (OAuth 2.0).

Expect questions about the security risks of different grant types, specifically why the Authorization Code flow is superior to the Implicit flow for protecting access tokens from being exposed in browser history.

❓ Frequently Asked Questions

What is the relationship between OAuth 2.0 and OpenID Connect (OIDC)?

OIDC is an identity layer built on top of OAuth 2.0. While OAuth 2.0 handles authorization (access tokens), OIDC adds authentication by providing an ID Token to verify who the user is.

Can OAuth 2.0 be used for Single Sign-On (SSO)?

By itself, no. OAuth 2.0 is for authorization. To achieve SSO, you must use an authentication protocol like SAML or the OIDC extension, which provides the necessary identity assertions.

Related Terms from Certified Information Systems Security Professional

Endpoint Detection and Response (EDR) Kerberos Security Assertion Markup Language (SAML) Non-Repudiation Man-in-the-Middle (MitM) Attack Single Sign-On (SSO)

📝 Related Study Guides

Study Guide 10 min read

How to Pass the CISSP Exam: A Realistic 2026 Study Plan

To pass the CISSP, you must transition from a technical mindset to a managerial one, focusing on risk management and policy over implementation. Success requires a 3-6 month study plan covering all eight domains, using adaptive practice exams to identify gaps and mastering the "mile wide, inch deep" breadth of the CBK.

Career Guide 10 min read

CISSP Experience Requirements: How to Get Your Waiver in 2026

To earn the CISSP, you need five years of cumulative, paid work experience in two or more of the eight CISSP domains. You can obtain a one-year waiver through a four-year college degree or approved professional certifications. Those lacking full experience can become an Associate of ISC2 after passing the exam.

Deep Dive 8 min read

Kerberos Authentication Explained for the CISSP Exam

Kerberos is a ticket-based authentication protocol designed to provide strong authentication for client/server applications by using secret-key cryptography. It utilizes a trusted third party called the Key Distribution Center (KDC) to issue tickets, enabling Single Sign-On (SSO) and preventing replay attacks through the use of synchronized timestamps.