OAuth Lab — Roles and Token Shape
Map roles, name a flow, separate tokens on 127.0.0.1:8814 —.
Visual · oauth_lab_roles_tokens
Lab: roles, flow name, id vs access. Bind 127.0.0.1:8814.
Paper map plus loopback curls — still zero phishing pages.
Lessons 1–3 named roles, flows, and OIDC tokens. This lab ships: a roles diagram note, a chosen flow name (code+PKCE or client credentials as the toy supports), and curls showing which token shape the RS accepts on 127.0.0.1:8814. Refuse 0.0.0.0. Never phishing kits. Never steal redirect codes. Next: Quiz — OAuth and OIDC.
1. Lab contract
. STOP if router. Start OAuth/OIDC toy on 127.0.0.1:8814. Confirm bind is loopback.
Write roles and flow name before curling. State explicitly: no fake IdP HTML.
Command guide
Try these commands — Lab contract
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OAuth 2.0 Security BCP — https://datatracker.ietf.org/doc/html/rfc9700 Auth0 PKCE — https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
curl -sS http://127.0.0.1:8814/.well-known/openid-configuration 2>/dev/null | jq '.issuer, .token_endpoint' || curl -sS -m 2 -I http://127.0.0.1:8814/
curl -sS -o /dev/null -w "token POST %{http_code}
" -X POST http://127.0.0.1:8814/oauth/token -H "Content-Type: application/x-www-form-urlencoded" -d "grant_type=client_credentials&client_id=lab"Primary tools to practice this lesson: curl, jq. Reference sites: OAuth 2.0 Security BCP (https://datatracker.ietf.org/doc/html/rfc9700); Auth0 PKCE (https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Token shape evidence
Obtain lab access token (and id_token if issued). Call RS with access token success; show wrong/missing token fail. If id_token is rejected as Bearer, record that teaching moment.
Save -D - transcripts under cyberlium-lab chmod 600.
3. Cleanup and ethics audit
Stop pid. Grep the lab folder for phishing kit filenames and delete if any appeared. Confirm redirects pointed at 127.0.0.1 only.
Quiz next — then Topic 13 continues to BOLA and IDOR.
4. What you ship: roles map, flow name, token evidence on YOUR lab
Roles + flow written. access token success / failure evidence. id vs access note. Bind 127.0.0.1:8814. No phishing. No 0.0.0.0.
5. What you record before the next lesson
Date. Flow name. Token statuses. File t13-m05-l04-oauth-lab.txt chmod 600.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
- Wrong: Stand up a fake Google login. Sniff café OAuth. Bind 0.0.0.0. hydra the token endpoint on a public IdP.
- Right: Loopback OAuth literacy pack. Next: Quiz — OAuth and OIDC.
Mission: OAuth literacy without impostors
1) / STOP if router. 2) Map roles + name flow on 127.0.0.1:8814. 3) Prove access-token gating; note id_token job. 4) Stop pid. chmod 600. Never phishing kits.
Stuck? Ask Cyberlium AI Mentor
If redirects fail, check the toy’s registered 127.0.0.1 redirect — do not switch to a public site.
APPLY: Lab snippet hosts /login that copies a bank’s HTML. You:
APPLY: True or False: Teaching bind for this lab is 127.0.0.1:8814.
APPLY: Using id_token as Bearer on an RS that expects access_token should: