title: Service-Based Authentication Using Tokens
body: <p>I'm having a tough time trying to find clear and concise examples of how one would implement a service-based authentication scheme using tokens.  As far as I can tell, the basic steps are as follows:</p>
  
  <ol>
  <li>Client requests username/password from user</li>
  <li>Client passes username/password to identity provider</li>
  <li>Provider checks username/password and sends back a token if the user is valid</li>
  <li>Client does something with the token?</li>
  </ol>
  
  <p>The third and fourth step are where I'm getting stuck.  I assume the "token" in this case just has to be either an encrypted string that the client can decrypt or some random string that gets stored somewhere (i.e. a database) that the client can then verify against, but I'm not really sure what the client is then supposed to do with the token or why you even need a token at all -- couldn't a simple user ID also suffice?</p>