title: OAuth Authorization vs Authentication
body: <p>OAuth terminology has been bothering me a long time now.  Is OAuth Authorization as some would suggest or is it Authentication?</p>
  
  <p>Correct me if I'm wrong but I have always read Authorization as being the act of allowing someone access to a resource yet OAuth doesn't seem to have any implementation that actually allows access to users to a given resource.  All OAuth implementations talk about is providing a user a token (signed and sometimes encrypted).  This token is then passed with every call to a back-end service endpoint where it is checked for validity, again not an OAuth concern.</p>
  
  <p>Is OAuth Authentication (every article says it isn't) which I take it requires a user to provide credentials which in turn proves a user should/shouldn't have access?</p>
  
  <p>So it seems that OAuth is not Authorization NOR Authentication since these have to be performed by other processes.  So what the heck is it?  Is it a process for communicating a token?  Is it fluff word that really has no specific meaning?</p>
  
  <p>It's hard to ask a question about this subject without sounding enigmatic and superstitious (ghosts and goblins) so I expect that answering this question won't be a simple thing either.  Enter at your own risk.  </p>