What is an opaque access token?

What is an opaque access token?

An opaque or a reference token is a random and a unique string of characters which has been issued by the token service as an identifier to be used for API authentication purposes.

What is the purpose of OAuth token?

OAuth doesn’t share password data but instead uses authorization tokens to prove an identity between consumers and service providers. OAuth is an authentication protocol that allows you to approve one application interacting with another on your behalf without giving away your password.

Is the OAuth token opaque to the client?

In OAuth, the token is designed to be opaque to the client, but in the context of a user authentication, the client needs to be able to derive some information from the token. This problem stems from the fact that the client is not the intended audience of the OAuth access token.

What is the benefit of the access token being opaque?

If you want the client to be able to parse the access token, you need the token to be transparent. If you don’t want the client to be able to parse the access token, you need the token to be opaque. Indeed, this is the definition of opaque and transparent tokens; the client can see into them, or not.

What are opaque access tokens in Cloud Foundry?

With the v3.3.0 release we introduce opaque and revocable tokens to clients and applications that use the UAA as an authorization server. The Cloud Foundry UAA, User Account and Authentication server is an OAuth 2 authorization server implementation, and responsible for a great deal of identity management in the Cloud Foundry platform.

What does OAuth tell the application about the user?

However, OAuth tells the application none of that. OAuth says absolutely nothing about the user, nor does it say how the user proved their presence or even if they’re still there. As far as an OAuth client is concerned, it asked for a token, got a token, and eventually used that token to access some API.