Guide to Machine to Machine (M2M) Authentication | IBM

Let’s use the example of a company’s nightly backup system. Every night at 11p.m., backup servers need to copy data from the company’s file server to secure backup storage. There are no employees sitting at a workstation to approve data requests at that hour, so the backup process uses M2M authentication.

First, the backup job identifies itself. Then, it requests permission to communicate with the file server by presenting its credential to the company’s IdP. It asks for a short-lived access token or refresh token to use the backup storage service.

The IdP checks the credential, confirming that the request is really from “backup-service.” It also checks whether the service is permitted to write backups to the designated storage location. If approved, the backup job receives a token that is valid for a limited time and intended only for the backup storage system.

The job connects to the backup storage service, sending the necessary files along with the token. The…