OAuth 2.0 is an authorization framework that lets an application obtain limited access to a user’s resources on another service without ever seeing that user’s password. Instead of handing over credentials, the user approves a scoped grant and the application receives an access token it presents to the resource server.
The flow involves four roles: the resource owner (the user), the client (the app requesting access), the authorization server (which issues tokens), and the resource server (which holds the data). A familiar example is a photo printing site asking to read the images in your cloud drive; you consent once, and the site gets a token scoped to read only, never your login. The mistake developers make constantly is treating OAuth as authentication. It answers what an app may do, not who the user is, so proving identity requires OpenID Connect layered on top. Bearer tokens should be short lived, and public clients should use PKCE to blunt code interception.
How is OAuth 2.0 tested on the CISSP?
OAuth 2.0 sits in Domain 5 (Identity and Access Management), weighted at 13% of the exam. Know the difference between authorization and authentication, the token roles, and where OAuth fits in federated access. Review Domain 5 Identity and Access Management for the surrounding concepts.