Backend interview prep

Start

OAuth2 Roles Interview Questions and Answers

Learn OAuth2 Roles with 10 interview questions, Mermaid diagrams, production examples, Spring Security integration, and enterprise best practices.

OAuth2 Roles - Interview Questions & Answers

OAuth2 defines four core roles that work together to provide secure authorization.

Understanding these roles is essential for designing secure applications and is one of the most frequently asked topics in Spring Security, OAuth2, Microservices, and Solution Architect interviews.

Q1. What are the OAuth2 Roles?

Answer

OAuth2 defines four primary roles:

  • Resource Owner
  • Client
  • Authorization Server
  • Resource Server

Each role has a specific responsibility during the authorization process.

OAuth2 Roles

flowchart LR

ResourceOwner["Resource Owner (User)"]

Client["Client Application"]

AuthorizationServer["Authorization Server"]

ResourceServer["Resource Server"]

ResourceOwner --> Client
Client --> AuthorizationServer
AuthorizationServer --> Client
Client --> ResourceServer

Q2. Who is the Resource Owner?

Answer

The Resource Owner is typically the end user who owns the protected data.

Examples:

  • Bank Customer
  • Gmail User
  • GitHub User
  • Facebook User

The Resource Owner grants permission to the client application.

Resource Owner

flowchart LR

User --> GrantPermission["Grant Permission"]

GrantPermission["Grant Permission"] --> ClientApplication["Client Application"]

Example

You allow a photo editing application to access your Google Photos.

Q3. What is the Client?

Answer

The Client is the application requesting access to the user's protected resources.

Examples:

  • Mobile App
  • Web Application
  • Single Page Application (SPA)
  • Backend Service

Client Flow

flowchart LR

ClientApplication["Client Application"] --> AuthorizationRequest["Authorization Request"]

AuthorizationRequest["Authorization Request"] --> AuthorizationServer["Authorization Server"]

Responsibilities

  • Redirect user for login
  • Request authorization
  • Exchange authorization code for tokens
  • Call protected APIs

Q4. What is the Authorization Server?

Answer

The Authorization Server authenticates users and issues OAuth2 tokens.

Responsibilities include:

  • User Authentication
  • User Consent
  • Token Generation
  • Token Validation
  • Refresh Token Issuance

Authorization Server

flowchart TD

User --> AuthorizationServer["Authorization Server"]

AuthorizationServer["Authorization Server"] --> AccessToken["Access Token"]

AuthorizationServer["Authorization Server"] --> RefreshToken["Refresh Token"]
  • Keycloak
  • Okta
  • Auth0
  • Microsoft Entra ID
  • Google Identity Platform

Q5. What is the Resource Server?

Answer

The Resource Server hosts protected APIs and resources.

It validates incoming Access Tokens before returning data.

Resource Server

flowchart LR

Client --> AccessToken["Access Token"]

AccessToken["Access Token"] --> ResourceServer["Resource Server"]

ResourceServer["Resource Server"] --> ProtectedData["Protected Data"]

Examples

  • Spring Boot REST API
  • Banking API
  • User Profile API
  • Payment API

Q6. How do all OAuth2 roles work together?

Answer

The OAuth2 authorization process involves all four roles.

OAuth2 Authorization Flow

sequenceDiagram
participant User
participant Client
participant AuthorizationServer
participant ResourceServer
User->>Client: Login
Client->>AuthorizationServer: Authorization Request
AuthorizationServer-->>User: Login Screen
User->>AuthorizationServer: Authenticate
AuthorizationServer-->>Client: Authorization Code
Client->>AuthorizationServer: Exchange Code
AuthorizationServer-->>Client: Access Token
Client->>ResourceServer: Access Token
ResourceServer-->>Client: Protected Resource

Q7. Which OAuth2 role issues the Access Token?

Answer

Only the Authorization Server issues Access Tokens.

Token Issuance

flowchart LR

AuthorizationServer["Authorization Server"] --> GenerateAccessToken["Generate Access Token"]

GenerateAccessToken["Generate Access Token"] --> Client

Interview Tip

The Resource Server never generates Access Tokens.

It only validates them.

Q8. Which OAuth2 role validates the Access Token?

Answer

The Resource Server validates every incoming Access Token before granting access.

Validation includes:

  • Signature
  • Expiration
  • Issuer
  • Audience
  • Scopes

Token Validation

flowchart TD

IncomingToken["Incoming Token"] --> ValidateSignature["Validate Signature"]

ValidateClaims["Validate Claims"] --> ValidateClaims["Validate Claims"]

GrantAccess["Grant Access"] --> GrantAccess["Grant Access"]

If validation fails, the API returns:

401 Unauthorized

Q9. How are OAuth2 roles implemented in Spring Security?

Answer

Spring Security separates responsibilities across different components.

OAuth2 Role Spring Security Component
Resource Owner User
Client Web/Mobile Application
Authorization Server Spring Authorization Server
Resource Server Spring Boot Resource Server

Spring Security Architecture

flowchart TD

User --> Client

Client --> SpringAuthorizationServer["Spring Authorization Server"]

SpringAuthorizationServer["Spring Authorization Server"] --> JwtAccessToken["JWT Access Token"]

JwtAccessToken["JWT Access Token"] --> SpringBootResourceServer["Spring Boot Resource Server"]

SpringBootResourceServer["Spring Boot Resource Server"] --> RestApis["REST APIs"]

Q10. What are the enterprise best practices for OAuth2 roles?

Answer

Follow these best practices:

  • Separate Authorization Server and Resource Server.
  • Keep Access Tokens short-lived.
  • Protect Client Secrets.
  • Use HTTPS everywhere.
  • Validate every Access Token.
  • Use scopes to limit access.
  • Implement Refresh Tokens securely.
  • Use JWT or opaque tokens based on system requirements.
  • Monitor authentication events.
  • Follow Zero Trust principles.

Enterprise OAuth2 Architecture

flowchart TD

User --> IdentityProvider["Identity Provider"]

IdentityProvider["Identity Provider"] --> AuthorizationServer["Authorization Server"]

AuthorizationServer["Authorization Server"] --> AccessToken["Access Token"]

AccessToken["Access Token"] --> ApiGateway["API Gateway"]

ApiGateway["API Gateway"] --> SpringBootResourceServer["Spring Boot Resource Server"]

SpringBootResourceServer["Spring Boot Resource Server"] --> Microservices

OAuth2 Roles Overview

mindmap
  root((OAuth2 Roles))
    Resource Owner
    Client
    Authorization Server
    Resource Server
    Access Token
    Refresh Token
    Protected APIs

Senior Interview Tip

A production-ready OAuth2 system clearly separates responsibilities:

  • Resource Owner → Owns the protected data.
  • Client → Requests access.
  • Authorization Server → Authenticates users and issues tokens.
  • Resource Server → Validates tokens and serves protected resources.

In enterprise architectures, these roles are commonly combined with:

  • Spring Security
  • Spring Authorization Server
  • OpenID Connect
  • JWT
  • API Gateway
  • OAuth2 Scopes
  • mTLS
  • Zero Trust Architecture

Quick Revision

  • OAuth2 defines four core roles.
  • Resource Owner is the user.
  • Client requests access on behalf of the user.
  • Authorization Server authenticates users and issues tokens.
  • Resource Server hosts protected APIs.
  • Authorization Server issues Access Tokens.
  • Resource Server validates Access Tokens.
  • Spring Authorization Server implements the Authorization Server role.
  • Spring Boot Resource Server protects REST APIs.
  • Enterprise systems combine OAuth2 with JWT, OpenID Connect, API Gateways, and Zero Trust.