How to implement an OAuth 2.0 Authorization Server?

Question

I understood how to write Running OAuth 2.0 code for the client side.

Using existing Authorization Server, like Google, seems to be not too complicated.

Question is: How to implement my own Authorization Server?

Since many companies have their own User/Privilege system, LDAP based (e.g. Active Directory), etc. - they must have their own Authorization Server.

Is there a framework, libraries, etc. for that? Or do I have to write the code from scratch?

Answer 1

The best reference is the OAuth 2.0 site. They list the available server libraries that you can use. Currently, the options are:

Java

• Apache Oltu
• Spring Security for OAuth
• Apis Authorization Server (v2-31)
• Restlet Framework (draft 30)
• Apache CXF

PHP

• PHP OAuth2 Server and Demo
• PHP OAuth 2.0 Auth and Resource Server and Demo
• PHP OAuth 2.0 (AS with SAML/BrowserID AuthN, with management REST API, see DEMO)

Python

• Python OAuth 2.0 Provider (see Tutorial)
• OAuthLib (a generic implementation of the OAuth request-signing logic) is avaliable for Django and Flask web frameworks

Other

• NodeJS OAuth 2.0 Provider
• Ruby OAuth2 Server (draft 18)
• .NET DotNetOpenAuth
• Erlang Oauth2 Server framework

I would also highly recommend that you read all the documentation available on how the standard works before getting started. There are many parts to OAuth and it can get confusing. At least, that's how I feel.