SIMULATION You are tasked with integrating a new B2B client application with an existing OAuth workflow that must meet the following requirements: - The application does not need to know the users'…

Submitted by yuki_2020· Mar 6, 2026Security Architecture - Implementing delegated authorization using OAuth 2.0, understanding the roles of Authorization Server, Resource Server, and Client Application, and applying least-privilege access through token scopes.

Question

SIMULATION You are tasked with integrating a new B2B client application with an existing OAuth workflow that must meet the following requirements: - The application does not need to know the users' credentials. - An approval interaction between the users and the HTTP service must be orchestrated. - The application must have limited access to users' data. INSTRUCTIONS Use the drop-down menus to select the action items for the appropriate locations. All placeholders must be filled. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button. Answer:

Exhibits

Explanation

The correct configuration maps each OAuth 2.0 role to its proper function: the Resource Server hosts protected user data and authorizes access to other applications, the Authorization Server issues and manages tokens (access tokens, refresh tokens) after validating consent, and the B2B Client Application redirects users to the Authorization Server to obtain delegated access without ever handling user credentials. This satisfies all three requirements: credentials are never exposed to the client app, the Authorization Server orchestrates the user approval/consent interaction, and scopes on the issued tokens limit what data the client can access.

Topics

#OAuth 2.0#Authorization Code Flow#API Security#Identity and Access Management

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice