OAuth 2.0 authentication in HTTP Module

Question

Is it possible to implement OAuth(Open Authorization) 2.0 or 1.0 in HTTP Module.

Why i m choosing this because, each and every request will first reaches the HTTP Module, so from that request i have to authenticate

Is it possible ?

If YES means , please like a related link for that

Help me..

Answer 1

Yes, this is possible. In fact mod_auth_openidc does exactly that for Apache (and for OpenId Connect, which is a protocol built on OAuth2).

More on the scenario here: https://auth0.com/blog/2014/08/22/sso-for-legacy-apps-with-auth0-openid-connect-and-apache/

Answer 2

I'm going to add to Eugenio's answer by saying that mod_auth_openidc supports two modes of operation:

1. it can function as an OpenID Connect Relying Party authenticating users by consuming and verifying ID tokens, access tokens and refresh tokens as issued by an OpenID Connect Provider; it will relay information about the authenticated user (and possibly the tokens themselves) to the protected application that runs on or behind the Apache server

2. it can function as an OAuth 2.0 Resource Server, controlling access from OAuth 2.0 clients by consuming and verifying access tokens that have been issued by an OAuth 2.0 Authorization Server; it can pass on information associated with the access token to the protected application that runs on or behind the Apache server

For both cases, Apache's Require logic can be used to enforce access based on certain claims that are present in the ID token resp. access token.

Update April 12, 2019:

There's now a dedicated module to handle the OAuth 2.0 Resource Server functionality: https://github.com/zmartzone/mod_oauth2