SlideShare a Scribd company logo

What the Heck is OAuth and OpenID Connect? Connect.Tech 2017

Matt Raible
Matt Raible

This document discusses OAuth 2.0 and OpenID Connect (OIDC) standards for authorization and authentication, explaining their roles, functionalities, and various flows involved. It covers the complexity of OAuth, its security concerns, and how OIDC extends OAuth to provide user identity information. Additionally, it outlines different grant types, token management, and practical use cases in modern applications.

Software
1 of 77
Downloaded 27 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
Matt Raible | @mraible What the Heck is OAuth and OIDC? September 22, 2017 Connect.Tech https://www.flickr.com/photos/rockmixer/2806330093
Blogger on raibledesigns.com Web Developer and Java Champion Father, Skier, Mountain Biker, Whitewater Rafter Open Source Connoisseur Who is Matt Raible? Bus Lover Okta Developer Advocate
What the Heck is OAuth and OpenID Connect? Connect.Tech 2017
What the Heck is OAuth and OpenID Connect? Connect.Tech 2017
What the Heck is OAuth and OpenID Connect? Connect.Tech 2017
Authentication Standards
What about You? Java, .NET, Python, or Node.js? Have you ever written authentication from scratch? Have you implemented OAuth or OIDC? Have you heard of Okta? Auth0? Why are you here?
Originally created by Karl McGuinness @jankytweet
OAuth 2.0 Overview
An open standard for authorization; anyone can implement it Provides “secure delegated access” to client applications Works over HTTPS and authorizes: Devices APIs Servers Applications … with access tokens rather than credentials What is OAuth?
Direct Authentication GET /index.html HTTP/1.1 Host: www.example.com Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
Federated Identity Identity Provider (IdP) Service Provider (SP) End User Trust Obtains Assertion Provides Assertion
How Federated Identity Works
SAML 2.0 OASIS Standard, 15 March 2005 Authentication Request Protocol Assertion
SAML 2.0 Authentication Request Protocol
SAML 2.0 Assertion <Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion" ID="b07b804c-7c29-ea16-7300-4f3d6f7928ac" Version="2.0" IssueInstant="2004-12-05T09:22:05" <Issuer>https://example.okta.com</Issuer> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">...</ds:Signature> <Subject> <NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"> matt@example.com </NameID> <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> </SubjectConfirmation> </Subject> <Conditions NotBefore="2004-12-05T09:17:05" NotOnOrAfter="2004-12-05T09:27:05"> <AudienceRestriction> <saml:Audience>https://sp.example.com/saml2/sso</saml:Audience> </AudienceRestriction> </Conditions> <AuthnStatement AuthnInstant="2004-12-05T09:22:00" SessionIndex="b07b804c-7c29-ea16-7300-4f3d6f7928ac"> <AuthnContext> <AuthnContextClassRef> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport </AuthnContextClassRef> </AuthnContext> </AuthnStatement> <AttributeStatement> <Attribute Name="displayName"> <AttributeValue>Matt Raible</AttributeValue> </Attribute> </AttributeStatement> </Assertion>
SAML = Web SSO
What the Heck is OAuth and OpenID Connect? Connect.Tech 2017
What’s Changed Since 2005?
Cloud-native applications are dynamic and public!
Modern and native applications
Connected experiences across devices
Simple Web APIs GET POST PUT DELETE
API Economy
2017: The Year of the API Economy
Delegated Authorization Problem How can a user authorize an app to access protected data on their behalf?
Have you ever seen one of these?
© Okta and/or its affiliates. All rights reserved. Okta Confidential
OAuth 2.0 Enables apps to obtain limited access (scopes) to a user’s data without giving away a user’s password Decouples authentication from authorization Supports multiple use cases addressing different client capabilities and deployment models Server-to-server apps Browser-based apps Mobile/Native apps Consoles/TVs Web-scale delegated authorization framework for REST/APIs Protecting APIs Since October 2012
Modern Applications Browser App Server App Web API Web API Web API Native App Web App
Hotel Key Cards, but for Apps
Hotel Key Cards, but for Apps OAuth Authorization Server Resource (API)Access Token
OAuth Simplified App requests authorization from User1 User authorizes App and delivers proof2 App presents proof of authorization to server to get a Token3 Token is restricted to only access what the User authorized for the specific App 4
OAuth 2.0 Actors Clients Scopes & Consent Tokens Authorization Server Flows
Authorization
 Server (AS) Resource Owner (RO) Client Delegates Obtains Token Uses Token Resource
 Server (RS) Actors
Authorization
 Server (AS) Resource Owner (RO) Client Delegates Obtains Token Uses Token Resource
 Server (RS) Actors
Clients Public (Client Identification) Confidential
 (Client Authentication)
Clients Client Registration is the DMV of OAuth
Scopes Additive bundles of permissions asked by client when requesting a token Decouples authorization policy decisions from enforcement Who owns the data? End user or the target service Who gets to specify the authorization policy? End user or application owner Scopes to Deny Scopes to Allow
Capturing User Consent Authorization Grant (Trust of First Use)
Tokens • Short-lived token used by Client to access Resource Server (API) • Opaque to the Client • No client authentication required (Public Clients) • Optimized for scale and performance • Revocation is dependent on implementation Access Token (Required) • Long-lived token that is used by Client to obtain new access tokens from Authorization Server • Usually requires Confidential Clients with authentication • Forces client to rotate secrets • Can usually be revoked Refresh Token (Optional) OAuth doesn’t define the format of a token!
Access Token Types Self-contained tokens Protected, time-limited data structure agreed upon between Authorization Server and Resource Server that contains metadata and claims about the identity of the user or client over the wire. Resource Server can validate the token locally by checking the signature, expected issuer name and expected audience or scope. Commonly implemented as a signed JSON Web Tokens (JWT) Reference tokens (aka opaque tokens) Infeasible-to-guess (secure-random) identifier for a token issued and stored by the OAuth 2.0 Authorization Server Resource Server must send the identifier via back-channel to the OAuth 2.0 Authorization Server’s token introspection endpoint to determine if the token is valid and obtain claims/scopes
JSON Web Token (JWT) base64url(Header) + “.” + base64url(Claims) + “.” + base64url(Signature) eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL2 V4YW1wbGUub2t0YS5jb20iLCJzdWIiOiIwMHVncmVuT WVxdllsYTRIVzBnMyIsImF1ZCI6IncyNTVIRVdpU1U0 QXVOeEVqZWlqIiwiaWF0IjoxNDQ2MzA1MjgyLCJleHA iOjE0NDYzMDg4ODIsImFtciI6WyJwd2QiXSwiYXV0aF 90aW1lIjoxNDQ2MzA1MjgyLCJlbWFpbCI6ImthcmxAZ XhhbXBsZS5jb20iLCJlbWFpbF92ZXJpZmllZCI6dHJ1 ZX0.XcNXs4C7DqpR22LLti777AMMVCxM7FjEPKZQnd- AS_Cc6R54wuQ5EApuY6GVFCkIlnfbNmYSbHMkO4H- L3uoeXVOPQmcqhNPDLLEChj00jQwZDjhPD9uBoNwGyi Z9_YKwsRpzbg9NEeY8xEwXJFIdk6SRktTFrVNHAOIhE Qsgm8 { "alg": "RS256”
 "kid": "123456789" } { "iss": "https://example.okta.com", "sub": "00ugrenMeqvYla4HW0g3", "aud": "w255HEWiSU4AuNxEjeij", "iat": 1446305282, "exp": 1446308882, "amr": [ "pwd" ], "auth_time": 1446305282, "email": "karl@example.com", "email_verified": true } Header Claims Signature Header Claims
Token Issuer and Audience Audience Issuer
Token Issuer and Audience Resource Server (RS) audience: api.example.com Authorization Server (AS) issuer: org.okta.com Resource Server (RS) audience: foo.example.com Resource Domain Client trust trust issuer (iss): org.okta.com audience (aud): api.example.com
Authorization Server Authorize Endpoint (/ oauth2/authorize) Token Endpoint (/oauth2/token) Authorization Server Authorization Grant Refresh Token Access Token Introspection Endpoint (/ oauth2/introspect) Revocation Endpoint (/ oauth2/revoke)
© Okta and/or its affiliates. All rights reserved. Okta Confidential Token State Management Developer Friction 47
Flow Channels Resource
 Server (RS) Authorization
 Server (AS) Resource Owner (RO) Client Delegates Obtains Token Uses Token Back Channel Front Channel
Front Channel Flow Authorize via User Agent Resource
 Server (RS) Authorization
 Server (AS) 4 2 3 1 Resource Owner starts flow to delegate access to protected resource 1 Client 2 Client sends authorization request with desired scopes via browser redirect to Authorize Endpoint on Authorization Server 3 User authenticates and consents to Delegated Access (Grant) 4 Authorization Code Grant or Access Token is returned to Client via browser redirect Resource Owner (RO)
Authorization Request GET https://accounts.google.com/o/oauth2/auth?
 scope=gmail.insert gmail.send&
 redirect_uri=https://app.example.com/oauth2/callback&
 response_type=code&
 client_id=812741506391&
 state=af0ifjsldkj HTTP/1.1 302 Found
 Location: https://app.example.com/oauth2/callback?
 code=MsCeLvIaQm6bTrgtp7&
 state=af0ifjsldkj Request Response Note: Parameters are not URL-encoded for example purposes
Back Channel Flow Exchange Grants for Tokens Resource
 Server (RS) Authorization
 Server (AS) 1 Client 2 Client accesses protected resource with Access Token Resource Owner (RO) 2 Client exchanges Authorization Code Grant with token endpoint on Authorization Server for an Access Token and optionally Refresh Token 1
Token Request POST /oauth2/v3/token HTTP/1.1 Host: www.googleapis.com Content-Type: application/x-www-form-urlencoded code=MsCeLvIaQm6bTrgtp7& client_id=812741506391& client_secret={client_secret}& redirect_uri=https://app.example.com/oauth2/callback& grant_type=authorization_code Note: Parameters are not URL-encoded for example purposes
Token Response { "access_token": "2YotnFZFEjr1zCsicMWpAA", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "tGzv3JOkF0XG5Qx2TlKWIA" }
Making Protected Resource Requests curl -H "Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA" https://www.googleapis.com/gmail/v1/users/1444587525/messages
OAuth 2.0 Grant Types (Flows) • Optimized for browser-only Public Clients • Access token returned directly from authorization request (Front-channel only) • Does not support refresh tokens • Assumes Resource Owner and Public Client are on the same device • Most vulnerable to security threats Implicit (2 Legged) • Front channel flow used by Client to obtain authorization code grant • Back channel flow used by Client to exchange authorization code grant for access token and optionally refresh token • Assumes Resource Owner and Client are on separate devices • Most secure flow as tokens never passes through user- agent Authorization Code (3 Legged) • Optimized for server-only Confidential Clients acting on behalf of itself or a user • Back-channel only flow to obtain an access token using the Client’s credentials • Supports shared secrets or assertions as Client credentials signed with either symmetric or asymmetric keys Client Credential
OAuth 2.0 Grant Types (Flows) • Legacy grant type for native username/password apps such as desktop apps • Username/password is authorization grant to obtain access token from Authorization Server • Does not support refresh tokens • Assumes Resource Owner and Public Client or on the same device Resource Owner Password • Allows Authorization Server to trust authorization grants from third party such as SAML IdP (Federation) • Assertion is used to obtain access token with token request • Does not support refresh tokens Assertion • Optimized for devices that do not have access to web- browsers • User code is returned from authorization request that must be redeemed by visiting a URL on a device with a browser to authorize • Back channel flow used by Client to poll for authorization approval for access token and optionally refresh token Device
OAuth Flows Six different flows Necessary because of: How you get consent from client? Who is making consent? Adds a lot of complexity to OAuth When people ask if you support OAuth, are they asking for all six? Image: Ian Sane, Spring Runoff
 https://www.flickr.com/photos/31246066@N04/4620052369
Common OAuth 2.0 Security Issues Too many inputs that need validation Token hijacking with CSRF Always use CSRF token with state parameter to ensure OAuth flow integrity Leaking authorization codes or tokens through redirects Always whitelist redirect URIs and ensure proper URI validations Token hijacking by switching clients Bind the same client to authorization grants and token requests Leaking client secrets Unbounded & Bearer Tokens See draft specification of OAuth Proof-of-Possession Token Extension
Key Enterprise OAuth 2.0 Use Cases Decouples authorization policy decisions from enforcement Enables the right blend of fine & coarse grained authorization Replaces traditional Web Access management (WAM) Policies Restrict and revoke which apps can access specific APIs Ensure only managed and/or complaint devices can access specific APIs Deep integration with identity deprovisioning workflow to revoke all tokens for a user and device Federation with an IdP
OAuth 2.0 Facts Not backward compatible with OAuth 1.0 Interoperability issues exists as its not a protocol but rather an authorization framework OAuth 2.0 is not an authentication protocol OAuth 2.0 alone says absolutely nothing about the user
© Okta and/or its affiliates. All rights reserved. Okta Confidential 61 Not an Authentication Protocol?
OAuth 2.0 as Pseudo-Authentication Client accessing a https:// api.example.com/me resource with an access token is not authenticating the user Access tokens just prove the Client was authorized, are opaque, and intended to only be consumed by the Resource Server Who is the user (claims)? When did the user authenticate? Does the user still have an active or expired session? How did the user authenticate? Just password or password + second factor As made famous by Facebook Connect and Twitter
OpenID Connect OpenID Connect
OpenID Connect Extends OAuth 2.0 with new signed id_token for the Client and UserInfo endpoint to fetch user attributes Provides a standard set of scopes and claims for identities profile email address phone Built-in registration, discovery & metadata for dynamic federations Bring Your Own Identity (BYOI) Supports high assurance levels and key SAML use cases (enterprise) OAuth 2.0 + Facebook Connect + SAML 2.0 (good parts)
Authorization Request GET https://accounts.google.com/o/oauth2/auth?
 scope=openid email&
 redirect_uri=https://app.example.com/oauth2/callback&
 response_type=code&
 client_id=812741506391&
 state=af0ifjsldkj HTTP/1.1 302 Found
 Location: https://app.example.com/oauth2/callback?
 code=MsCeLvIaQm6bTrgtp7&
 state=af0ifjsldkj Request Response Note: Parameters are not URL-encoded for example purposes
Token Request POST /oauth2/v3/token HTTP/1.1 Host: www.googleapis.com Content-Type: application/x-www-form-urlencoded code=MsCeLvIaQm6bTrgtp7& client_id=812741506391& client_secret={client_secret}& redirect_uri=https://app.example.com/oauth2/callback& grant_type=authorization_code Note: Parameters are not URL-encoded for example purposes
Token Response { "access_token": "2YotnFZFEjr1zCsicMWpAA", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "tGzv3JOkF0XG5Qx2TlKWIA", "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjFlOWdkazcifQ..." }
Validate ID Token Token Endpoint Authorization Endpoint /.well-known/
 openid-configuration JWKS Endpoint UserInfo Endpoint OAuth 2.0 Authorization Server & OpenID Connect Provider (OP) OAuth 2.0 Resource Server Client (Relying Party) 1 3 2 54 1 Discover OpenID Provider Metadata 2 Perform OAuth flow to obtain a ID token and/or access token 3 Get JSON Web Key Set (JWKS) for signature keys 4 Validate ID token
 (JSON Web Token) 5 Get additional user attributes with access token from UserInfo endpoint OpenID Connect
developer.okta.com
Okta OpenID Connect Integrates with Okta Authentication API for branded Sign-In UX Certified for the following conformance profiles: OP Basic OP Implicit OP Hybrid OP Config
Sign-In Widget and JS Auth SDK 71 Open-source embeddable widget for end-to-end sign-in flow with MFA and account recovery Returns an ID Token for authenticated user Supports social authentication providers Built-on common JS Auth SDK Open source: https://github.com/okta/okta-signin- widget
Sign-In Widget and JS Auth SDK Wraps Okta authentication and session management APIs in JS callbacks for custom UX Implements custom web messaging OAuth 2.0 response mode (okta-post- message) for single page applications with hidden iframe Open source: https://github.com/okta/okta-auth-js authClient.signIn({ username: 'some-username', password: 'some-password' }) .then(function(transaction) { if (transaction.status === 'SUCCESS') { authClient.session.setCookieAndRedirect(transaction.sessionToken); } });
Google OAuth Client Library ScribeJava Spring Security OAuth Nimbus OAuth SDK List of client and server libraries for many languages: https://oauth.net/code/ OAuth and OIDC Libraries
ORY Hydra https://github.com/ory/hydra Apereo CAS https://github.com/apereo/cas Keycloak https://github.com/keycloak/keycloak JHipster UAA https://jhipster.github.io/using-uaa/ Open Source OAuth and OIDC Servers
OAuth Specification oauth.net OAuth 2.0 Servers oauth.com Additional Resources
developer.okta.com/blog/
Questions? Keep in touch! raibledesigns.com @mraible Presentations speakerdeck.com/mraible Code github.com/oktadeveloper

More Related Content

What's hot (20)

PPTX
W3 conf hill-html5-security-realities
Brad Hill
 
PDF
Demystifying OAuth 2.0
Karl McGuinness
 
PPTX
An Introduction to OAuth2
Aaron Parecki
 
PDF
2016 pycontw web api authentication
Micron Technology
 
PDF
Stateless authentication for microservices
Alvaro Sanchez-Mariscal
 
PDF
OAuth2 and Spring Security
Orest Ivasiv
 
PDF
From 0 to Spring Security 4.0
robwinch
 
PDF
Front End Development for Back End Developers - Denver Startup Week 2017
Matt Raible
 
PDF
Stateless authentication for microservices - Greach 2015
Alvaro Sanchez-Mariscal
 
PPTX
Build A Killer Client For Your REST+JSON API
Stormpath
 
PPTX
Elegant Rest Design Webinar
Stormpath
 
PDF
What the Heck is OAuth and OIDC - Denver Developer Identity Workshop 2020
Matt Raible
 
PPTX
Build a Node.js Client for Your REST+JSON API
Stormpath
 
PDF
OAuth Hacks A gentle introduction to OAuth 2 and Apache Oltu
Antonio Sanso
 
PPTX
Esquema de pasos de ejecución IdM
Fernando Lopez Aguilar
 
PPTX
Making Sense of API Access Control
CA API Management
 
PPTX
Oauth 2.0 security
vinoth kumar
 
PPTX
Building Secure User Interfaces With JWTs (JSON Web Tokens)
Stormpath
 
PPTX
Building Secure User Interfaces With JWTs
robertjd
 
PPTX
Oauth2 and OWSM OAuth2 support
Gaurav Sharma
 
W3 conf hill-html5-security-realities
Brad Hill
 
Demystifying OAuth 2.0
Karl McGuinness
 
An Introduction to OAuth2
Aaron Parecki
 
2016 pycontw web api authentication
Micron Technology
 
Stateless authentication for microservices
Alvaro Sanchez-Mariscal
 
OAuth2 and Spring Security
Orest Ivasiv
 
From 0 to Spring Security 4.0
robwinch
 
Front End Development for Back End Developers - Denver Startup Week 2017
Matt Raible
 
Stateless authentication for microservices - Greach 2015
Alvaro Sanchez-Mariscal
 
Build A Killer Client For Your REST+JSON API
Stormpath
 
Elegant Rest Design Webinar
Stormpath
 
What the Heck is OAuth and OIDC - Denver Developer Identity Workshop 2020
Matt Raible
 
Build a Node.js Client for Your REST+JSON API
Stormpath
 
OAuth Hacks A gentle introduction to OAuth 2 and Apache Oltu
Antonio Sanso
 
Esquema de pasos de ejecución IdM
Fernando Lopez Aguilar
 
Making Sense of API Access Control
CA API Management
 
Oauth 2.0 security
vinoth kumar
 
Building Secure User Interfaces With JWTs (JSON Web Tokens)
Stormpath
 
Building Secure User Interfaces With JWTs
robertjd
 
Oauth2 and OWSM OAuth2 support
Gaurav Sharma
 

Similar to What the Heck is OAuth and OpenID Connect? Connect.Tech 2017 (20)

PDF
What the Heck is OAuth and Open ID Connect? - UberConf 2017
Matt Raible
 
PDF
RFC6749 et alia 20130504
Mattias Jidhage
 
PPTX
Intro to OAuth2 and OpenID Connect
LiamWadman
 
PDF
JDD2015: Security in the era of modern applications and services - Bolesław D...
PROIDEA
 
PPTX
An introduction to OAuth 2
Sanjoy Kumar Roy
 
PDF
OAuth and why you should use it
Sergey Podgornyy
 
PDF
ConFoo 2015 - Securing RESTful resources with OAuth2
Rodrigo Cândido da Silva
 
PPTX
Devteach 2017 OAuth and Open id connect demystified
Taswar Bhatti
 
PPT
OAuth 2.0 and OpenId Connect
Saran Doraiswamy
 
PDF
JHipster and Okta - JHipster Virtual Meetup December 2020
Matt Raible
 
PDF
APIdays Paris 2019 - Workshop: OAuth by Example by Andy March, Okta
apidays
 
PDF
OAuth2
SPARK MEDIA
 
PDF
AllTheTalks.Online 2020: "Basics of OAuth 2.0 and OpenID Connect"
Andreas Falk
 
PDF
OAuth Base Camp
Oliver Pfaff
 
PPTX
OAuth 2.0 - The fundamentals, the good , the bad, technical primer and commo...
Good Dog Labs, Inc.
 
PDF
CIS13: Introduction to OAuth 2.0
CloudIDSummit
 
PDF
OAuth in the Real World featuring Webshell
CA API Management
 
PDF
Demystifying OAuth 2.0
Yury Roa
 
PPTX
Api security
teodorcotruta
 
PDF
CIS14: Working with OAuth and OpenID Connect
CloudIDSummit
 
What the Heck is OAuth and Open ID Connect? - UberConf 2017
Matt Raible
 
RFC6749 et alia 20130504
Mattias Jidhage
 
Intro to OAuth2 and OpenID Connect
LiamWadman
 
JDD2015: Security in the era of modern applications and services - Bolesław D...
PROIDEA
 
An introduction to OAuth 2
Sanjoy Kumar Roy
 
OAuth and why you should use it
Sergey Podgornyy
 
ConFoo 2015 - Securing RESTful resources with OAuth2
Rodrigo Cândido da Silva
 
Devteach 2017 OAuth and Open id connect demystified
Taswar Bhatti
 
OAuth 2.0 and OpenId Connect
Saran Doraiswamy
 
JHipster and Okta - JHipster Virtual Meetup December 2020
Matt Raible
 
APIdays Paris 2019 - Workshop: OAuth by Example by Andy March, Okta
apidays
 
OAuth2
SPARK MEDIA
 
AllTheTalks.Online 2020: "Basics of OAuth 2.0 and OpenID Connect"
Andreas Falk
 
OAuth Base Camp
Oliver Pfaff
 
OAuth 2.0 - The fundamentals, the good , the bad, technical primer and commo...
Good Dog Labs, Inc.
 
CIS13: Introduction to OAuth 2.0
CloudIDSummit
 
OAuth in the Real World featuring Webshell
CA API Management
 
Demystifying OAuth 2.0
Yury Roa
 
Api security
teodorcotruta
 
CIS14: Working with OAuth and OpenID Connect
CloudIDSummit
 
Ad

More from Matt Raible (20)

PDF
Keep Identities in Sync the SCIMple Way - ApacheCon NA 2022
Matt Raible
 
PDF
Micro Frontends for Java Microservices - Belfast JUG 2022
Matt Raible
 
PDF
Micro Frontends for Java Microservices - Dublin JUG 2022
Matt Raible
 
PDF
Micro Frontends for Java Microservices - Cork JUG 2022
Matt Raible
 
PDF
Comparing Native Java REST API Frameworks - Seattle JUG 2022
Matt Raible
 
PDF
Reactive Java Microservices with Spring Boot and JHipster - Spring I/O 2022
Matt Raible
 
PDF
Comparing Native Java REST API Frameworks - Devoxx France 2022
Matt Raible
 
PDF
Lock That Sh*t Down! Auth Security Patterns for Apps, APIs, and Infra - Devne...
Matt Raible
 
PDF
Native Java with Spring Boot and JHipster - Garden State JUG 2021
Matt Raible
 
PDF
Java REST API Framework Comparison - PWX 2021
Matt Raible
 
PDF
Web App Security for Java Developers - PWX 2021
Matt Raible
 
PDF
Mobile App Development with Ionic, React Native, and JHipster - Connect.Tech ...
Matt Raible
 
PDF
Lock That Shit Down! Auth Security Patterns for Apps, APIs, and Infra - Joker...
Matt Raible
 
PDF
Web App Security for Java Developers - UberConf 2021
Matt Raible
 
PDF
Java REST API Framework Comparison - UberConf 2021
Matt Raible
 
PDF
Native Java with Spring Boot and JHipster - SF JUG 2021
Matt Raible
 
PDF
Lock That Shit Down! Auth Security Patterns for Apps, APIs, and Infra - Sprin...
Matt Raible
 
PDF
Reactive Java Microservices with Spring Boot and JHipster - Denver JUG 2021
Matt Raible
 
PDF
Get Hip with JHipster - Colorado Springs Open Source User Group 2021
Matt Raible
 
PDF
Java REST API Comparison: Micronaut, Quarkus, and Spring Boot - jconf.dev 2020
Matt Raible
 
Keep Identities in Sync the SCIMple Way - ApacheCon NA 2022
Matt Raible
 
Micro Frontends for Java Microservices - Belfast JUG 2022
Matt Raible
 
Micro Frontends for Java Microservices - Dublin JUG 2022
Matt Raible
 
Micro Frontends for Java Microservices - Cork JUG 2022
Matt Raible
 
Comparing Native Java REST API Frameworks - Seattle JUG 2022
Matt Raible
 
Reactive Java Microservices with Spring Boot and JHipster - Spring I/O 2022
Matt Raible
 
Comparing Native Java REST API Frameworks - Devoxx France 2022
Matt Raible
 
Lock That Sh*t Down! Auth Security Patterns for Apps, APIs, and Infra - Devne...
Matt Raible
 
Native Java with Spring Boot and JHipster - Garden State JUG 2021
Matt Raible
 
Java REST API Framework Comparison - PWX 2021
Matt Raible
 
Web App Security for Java Developers - PWX 2021
Matt Raible
 
Mobile App Development with Ionic, React Native, and JHipster - Connect.Tech ...
Matt Raible
 
Lock That Shit Down! Auth Security Patterns for Apps, APIs, and Infra - Joker...
Matt Raible
 
Web App Security for Java Developers - UberConf 2021
Matt Raible
 
Java REST API Framework Comparison - UberConf 2021
Matt Raible
 
Native Java with Spring Boot and JHipster - SF JUG 2021
Matt Raible
 
Lock That Shit Down! Auth Security Patterns for Apps, APIs, and Infra - Sprin...
Matt Raible
 
Reactive Java Microservices with Spring Boot and JHipster - Denver JUG 2021
Matt Raible
 
Get Hip with JHipster - Colorado Springs Open Source User Group 2021
Matt Raible
 
Java REST API Comparison: Micronaut, Quarkus, and Spring Boot - jconf.dev 2020
Matt Raible
 
Ad

Recently uploaded (20)

PPTX
ChiSquare Procedure in IBM SPSS Statistics Version 31.pptx
Version 1 Analytics
 
PDF
Driver Easy Pro 6.1.1 Crack Licensce key 2025 FREE
utfefguu
 
PDF
Technical-Careers-Roadmap-in-Software-Market.pdf
Hussein Ali
 
PDF
iTop VPN With Crack Lifetime Activation Key-CODE
utfefguu
 
PDF
Download Canva Pro 2025 PC Crack Full Latest Version
bashirkhan333g
 
PDF
AI + DevOps = Smart Automation with devseccops.ai.pdf
Devseccops.ai
 
PDF
NEW-Viral>Wondershare Filmora 14.5.18.12900 Crack Free
sherryg1122g
 
PDF
SAP Firmaya İade ABAB Kodları - ABAB ile yazılmıl hazır kod örneği
Salih Küçük
 
PDF
TheFutureIsDynamic-BoxLang witch Luis Majano.pdf
Ortus Solutions, Corp
 
PPTX
Customise Your Correlation Table in IBM SPSS Statistics.pptx
Version 1 Analytics
 
PDF
Odoo CRM vs Zoho CRM: Honest Comparison 2025
Odiware Technologies Private Limited
 
PPTX
Coefficient of Variance in IBM SPSS Statistics Version 31.pptx
Version 1 Analytics
 
PDF
How to Hire AI Developers_ Step-by-Step Guide in 2025.pdf
DianApps Technologies
 
PDF
SciPy 2025 - Packaging a Scientific Python Project
Henry Schreiner
 
PDF
The 5 Reasons for IT Maintenance - Arna Softech
Arna Softech
 
PPTX
Hardware(Central Processing Unit ) CU and ALU
RizwanaKalsoom2
 
PPTX
Empowering Asian Contributions: The Rise of Regional User Groups in Open Sour...
Shane Coughlan
 
PPTX
Comprehensive Risk Assessment Module for Smarter Risk Management
EHA Soft Solutions
 
PDF
Empower Your Tech Vision- Why Businesses Prefer to Hire Remote Developers fro...
logixshapers59
 
PDF
IDM Crack with Internet Download Manager 6.42 Build 43 with Patch Latest 2025
bashirkhan333g
 
ChiSquare Procedure in IBM SPSS Statistics Version 31.pptx
Version 1 Analytics
 
Driver Easy Pro 6.1.1 Crack Licensce key 2025 FREE
utfefguu
 
Technical-Careers-Roadmap-in-Software-Market.pdf
Hussein Ali
 
iTop VPN With Crack Lifetime Activation Key-CODE
utfefguu
 
Download Canva Pro 2025 PC Crack Full Latest Version
bashirkhan333g
 
AI + DevOps = Smart Automation with devseccops.ai.pdf
Devseccops.ai
 
NEW-Viral>Wondershare Filmora 14.5.18.12900 Crack Free
sherryg1122g
 
SAP Firmaya İade ABAB Kodları - ABAB ile yazılmıl hazır kod örneği
Salih Küçük
 
TheFutureIsDynamic-BoxLang witch Luis Majano.pdf
Ortus Solutions, Corp
 
Customise Your Correlation Table in IBM SPSS Statistics.pptx
Version 1 Analytics
 
Odoo CRM vs Zoho CRM: Honest Comparison 2025
Odiware Technologies Private Limited
 
Coefficient of Variance in IBM SPSS Statistics Version 31.pptx
Version 1 Analytics
 
How to Hire AI Developers_ Step-by-Step Guide in 2025.pdf
DianApps Technologies
 
SciPy 2025 - Packaging a Scientific Python Project
Henry Schreiner
 
The 5 Reasons for IT Maintenance - Arna Softech
Arna Softech
 
Hardware(Central Processing Unit ) CU and ALU
RizwanaKalsoom2
 
Empowering Asian Contributions: The Rise of Regional User Groups in Open Sour...
Shane Coughlan
 
Comprehensive Risk Assessment Module for Smarter Risk Management
EHA Soft Solutions
 
Empower Your Tech Vision- Why Businesses Prefer to Hire Remote Developers fro...
logixshapers59
 
IDM Crack with Internet Download Manager 6.42 Build 43 with Patch Latest 2025
bashirkhan333g
 

What the Heck is OAuth and OpenID Connect? Connect.Tech 2017

  • 1. Matt Raible | @mraible What the Heck is OAuth and OIDC? September 22, 2017 Connect.Tech https://www.flickr.com/photos/rockmixer/2806330093
  • 2. Blogger on raibledesigns.com Web Developer and Java Champion Father, Skier, Mountain Biker, Whitewater Rafter Open Source Connoisseur Who is Matt Raible? Bus Lover Okta Developer Advocate
  • 7. What about You? Java, .NET, Python, or Node.js? Have you ever written authentication from scratch? Have you implemented OAuth or OIDC? Have you heard of Okta? Auth0? Why are you here?
  • 8. Originally created by Karl McGuinness @jankytweet
  • 10. An open standard for authorization; anyone can implement it Provides “secure delegated access” to client applications Works over HTTPS and authorizes: Devices APIs Servers Applications … with access tokens rather than credentials What is OAuth?
  • 11. Direct Authentication GET /index.html HTTP/1.1 Host: www.example.com Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
  • 12. Federated Identity Identity Provider (IdP) Service Provider (SP) End User Trust Obtains Assertion Provides Assertion
  • 14. SAML 2.0 OASIS Standard, 15 March 2005 Authentication Request Protocol Assertion
  • 15. SAML 2.0 Authentication Request Protocol
  • 16. SAML 2.0 Assertion <Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion" ID="b07b804c-7c29-ea16-7300-4f3d6f7928ac" Version="2.0" IssueInstant="2004-12-05T09:22:05" <Issuer>https://example.okta.com</Issuer> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">...</ds:Signature> <Subject> <NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"> [email protected] </NameID> <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> </SubjectConfirmation> </Subject> <Conditions NotBefore="2004-12-05T09:17:05" NotOnOrAfter="2004-12-05T09:27:05"> <AudienceRestriction> <saml:Audience>https://sp.example.com/saml2/sso</saml:Audience> </AudienceRestriction> </Conditions> <AuthnStatement AuthnInstant="2004-12-05T09:22:00" SessionIndex="b07b804c-7c29-ea16-7300-4f3d6f7928ac"> <AuthnContext> <AuthnContextClassRef> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport </AuthnContextClassRef> </AuthnContext> </AuthnStatement> <AttributeStatement> <Attribute Name="displayName"> <AttributeValue>Matt Raible</AttributeValue> </Attribute> </AttributeStatement> </Assertion>
  • 17. SAML = Web SSO
  • 20. Cloud-native applications are dynamic and public!
  • 21. Modern and native applications
  • 23. Simple Web APIs GET POST PUT DELETE
  • 25. 2017: The Year of the API Economy
  • 26. Delegated Authorization Problem How can a user authorize an app to access protected data on their behalf?
  • 27. Have you ever seen one of these?
  • 28. © Okta and/or its affiliates. All rights reserved. Okta Confidential
  • 29. OAuth 2.0 Enables apps to obtain limited access (scopes) to a user’s data without giving away a user’s password Decouples authentication from authorization Supports multiple use cases addressing different client capabilities and deployment models Server-to-server apps Browser-based apps Mobile/Native apps Consoles/TVs Web-scale delegated authorization framework for REST/APIs Protecting APIs Since October 2012
  • 30. Modern Applications Browser App Server App Web API Web API Web API Native App Web App
  • 31. Hotel Key Cards, but for Apps
  • 32. Hotel Key Cards, but for Apps OAuth Authorization Server Resource (API)Access Token
  • 33. OAuth Simplified App requests authorization from User1 User authorizes App and delivers proof2 App presents proof of authorization to server to get a Token3 Token is restricted to only access what the User authorized for the specific App 4
  • 34. OAuth 2.0 Actors Clients Scopes & Consent Tokens Authorization Server Flows
  • 35. Authorization
 Server (AS) Resource Owner (RO) Client Delegates Obtains Token Uses Token Resource
 Server (RS) Actors
  • 36. Authorization
 Server (AS) Resource Owner (RO) Client Delegates Obtains Token Uses Token Resource
 Server (RS) Actors
  • 38. Clients Client Registration is the DMV of OAuth
  • 39. Scopes Additive bundles of permissions asked by client when requesting a token Decouples authorization policy decisions from enforcement Who owns the data? End user or the target service Who gets to specify the authorization policy? End user or application owner Scopes to Deny Scopes to Allow
  • 40. Capturing User Consent Authorization Grant (Trust of First Use)
  • 41. Tokens • Short-lived token used by Client to access Resource Server (API) • Opaque to the Client • No client authentication required (Public Clients) • Optimized for scale and performance • Revocation is dependent on implementation Access Token (Required) • Long-lived token that is used by Client to obtain new access tokens from Authorization Server • Usually requires Confidential Clients with authentication • Forces client to rotate secrets • Can usually be revoked Refresh Token (Optional) OAuth doesn’t define the format of a token!
  • 42. Access Token Types Self-contained tokens Protected, time-limited data structure agreed upon between Authorization Server and Resource Server that contains metadata and claims about the identity of the user or client over the wire. Resource Server can validate the token locally by checking the signature, expected issuer name and expected audience or scope. Commonly implemented as a signed JSON Web Tokens (JWT) Reference tokens (aka opaque tokens) Infeasible-to-guess (secure-random) identifier for a token issued and stored by the OAuth 2.0 Authorization Server Resource Server must send the identifier via back-channel to the OAuth 2.0 Authorization Server’s token introspection endpoint to determine if the token is valid and obtain claims/scopes
  • 43. JSON Web Token (JWT) base64url(Header) + “.” + base64url(Claims) + “.” + base64url(Signature) eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL2 V4YW1wbGUub2t0YS5jb20iLCJzdWIiOiIwMHVncmVuT WVxdllsYTRIVzBnMyIsImF1ZCI6IncyNTVIRVdpU1U0 QXVOeEVqZWlqIiwiaWF0IjoxNDQ2MzA1MjgyLCJleHA iOjE0NDYzMDg4ODIsImFtciI6WyJwd2QiXSwiYXV0aF 90aW1lIjoxNDQ2MzA1MjgyLCJlbWFpbCI6ImthcmxAZ XhhbXBsZS5jb20iLCJlbWFpbF92ZXJpZmllZCI6dHJ1 ZX0.XcNXs4C7DqpR22LLti777AMMVCxM7FjEPKZQnd- AS_Cc6R54wuQ5EApuY6GVFCkIlnfbNmYSbHMkO4H- L3uoeXVOPQmcqhNPDLLEChj00jQwZDjhPD9uBoNwGyi Z9_YKwsRpzbg9NEeY8xEwXJFIdk6SRktTFrVNHAOIhE Qsgm8 { "alg": "RS256”
 "kid": "123456789" } { "iss": "https://example.okta.com", "sub": "00ugrenMeqvYla4HW0g3", "aud": "w255HEWiSU4AuNxEjeij", "iat": 1446305282, "exp": 1446308882, "amr": [ "pwd" ], "auth_time": 1446305282, "email": "[email protected]", "email_verified": true } Header Claims Signature Header Claims
  • 44. Token Issuer and Audience Audience Issuer
  • 45. Token Issuer and Audience Resource Server (RS) audience: api.example.com Authorization Server (AS) issuer: org.okta.com Resource Server (RS) audience: foo.example.com Resource Domain Client trust trust issuer (iss): org.okta.com audience (aud): api.example.com
  • 46. Authorization Server Authorize Endpoint (/ oauth2/authorize) Token Endpoint (/oauth2/token) Authorization Server Authorization Grant Refresh Token Access Token Introspection Endpoint (/ oauth2/introspect) Revocation Endpoint (/ oauth2/revoke)
  • 47. © Okta and/or its affiliates. All rights reserved. Okta Confidential Token State Management Developer Friction 47
  • 48. Flow Channels Resource
 Server (RS) Authorization
 Server (AS) Resource Owner (RO) Client Delegates Obtains Token Uses Token Back Channel Front Channel
  • 49. Front Channel Flow Authorize via User Agent Resource
 Server (RS) Authorization
 Server (AS) 4 2 3 1 Resource Owner starts flow to delegate access to protected resource 1 Client 2 Client sends authorization request with desired scopes via browser redirect to Authorize Endpoint on Authorization Server 3 User authenticates and consents to Delegated Access (Grant) 4 Authorization Code Grant or Access Token is returned to Client via browser redirect Resource Owner (RO)
  • 50. Authorization Request GET https://accounts.google.com/o/oauth2/auth?
 scope=gmail.insert gmail.send&
 redirect_uri=https://app.example.com/oauth2/callback&
 response_type=code&
 client_id=812741506391&
 state=af0ifjsldkj HTTP/1.1 302 Found
 Location: https://app.example.com/oauth2/callback?
 code=MsCeLvIaQm6bTrgtp7&
 state=af0ifjsldkj Request Response Note: Parameters are not URL-encoded for example purposes
  • 51. Back Channel Flow Exchange Grants for Tokens Resource
 Server (RS) Authorization
 Server (AS) 1 Client 2 Client accesses protected resource with Access Token Resource Owner (RO) 2 Client exchanges Authorization Code Grant with token endpoint on Authorization Server for an Access Token and optionally Refresh Token 1
  • 52. Token Request POST /oauth2/v3/token HTTP/1.1 Host: www.googleapis.com Content-Type: application/x-www-form-urlencoded code=MsCeLvIaQm6bTrgtp7& client_id=812741506391& client_secret={client_secret}& redirect_uri=https://app.example.com/oauth2/callback& grant_type=authorization_code Note: Parameters are not URL-encoded for example purposes
  • 53. Token Response { "access_token": "2YotnFZFEjr1zCsicMWpAA", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "tGzv3JOkF0XG5Qx2TlKWIA" }
  • 54. Making Protected Resource Requests curl -H "Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA" https://www.googleapis.com/gmail/v1/users/1444587525/messages
  • 55. OAuth 2.0 Grant Types (Flows) • Optimized for browser-only Public Clients • Access token returned directly from authorization request (Front-channel only) • Does not support refresh tokens • Assumes Resource Owner and Public Client are on the same device • Most vulnerable to security threats Implicit (2 Legged) • Front channel flow used by Client to obtain authorization code grant • Back channel flow used by Client to exchange authorization code grant for access token and optionally refresh token • Assumes Resource Owner and Client are on separate devices • Most secure flow as tokens never passes through user- agent Authorization Code (3 Legged) • Optimized for server-only Confidential Clients acting on behalf of itself or a user • Back-channel only flow to obtain an access token using the Client’s credentials • Supports shared secrets or assertions as Client credentials signed with either symmetric or asymmetric keys Client Credential
  • 56. OAuth 2.0 Grant Types (Flows) • Legacy grant type for native username/password apps such as desktop apps • Username/password is authorization grant to obtain access token from Authorization Server • Does not support refresh tokens • Assumes Resource Owner and Public Client or on the same device Resource Owner Password • Allows Authorization Server to trust authorization grants from third party such as SAML IdP (Federation) • Assertion is used to obtain access token with token request • Does not support refresh tokens Assertion • Optimized for devices that do not have access to web- browsers • User code is returned from authorization request that must be redeemed by visiting a URL on a device with a browser to authorize • Back channel flow used by Client to poll for authorization approval for access token and optionally refresh token Device
  • 57. OAuth Flows Six different flows Necessary because of: How you get consent from client? Who is making consent? Adds a lot of complexity to OAuth When people ask if you support OAuth, are they asking for all six? Image: Ian Sane, Spring Runoff
 https://www.flickr.com/photos/31246066@N04/4620052369
  • 58. Common OAuth 2.0 Security Issues Too many inputs that need validation Token hijacking with CSRF Always use CSRF token with state parameter to ensure OAuth flow integrity Leaking authorization codes or tokens through redirects Always whitelist redirect URIs and ensure proper URI validations Token hijacking by switching clients Bind the same client to authorization grants and token requests Leaking client secrets Unbounded & Bearer Tokens See draft specification of OAuth Proof-of-Possession Token Extension
  • 59. Key Enterprise OAuth 2.0 Use Cases Decouples authorization policy decisions from enforcement Enables the right blend of fine & coarse grained authorization Replaces traditional Web Access management (WAM) Policies Restrict and revoke which apps can access specific APIs Ensure only managed and/or complaint devices can access specific APIs Deep integration with identity deprovisioning workflow to revoke all tokens for a user and device Federation with an IdP
  • 60. OAuth 2.0 Facts Not backward compatible with OAuth 1.0 Interoperability issues exists as its not a protocol but rather an authorization framework OAuth 2.0 is not an authentication protocol OAuth 2.0 alone says absolutely nothing about the user
  • 61. © Okta and/or its affiliates. All rights reserved. Okta Confidential 61 Not an Authentication Protocol?
  • 62. OAuth 2.0 as Pseudo-Authentication Client accessing a https:// api.example.com/me resource with an access token is not authenticating the user Access tokens just prove the Client was authorized, are opaque, and intended to only be consumed by the Resource Server Who is the user (claims)? When did the user authenticate? Does the user still have an active or expired session? How did the user authenticate? Just password or password + second factor As made famous by Facebook Connect and Twitter
  • 64. OpenID Connect Extends OAuth 2.0 with new signed id_token for the Client and UserInfo endpoint to fetch user attributes Provides a standard set of scopes and claims for identities profile email address phone Built-in registration, discovery & metadata for dynamic federations Bring Your Own Identity (BYOI) Supports high assurance levels and key SAML use cases (enterprise) OAuth 2.0 + Facebook Connect + SAML 2.0 (good parts)
  • 65. Authorization Request GET https://accounts.google.com/o/oauth2/auth?
 scope=openid email&
 redirect_uri=https://app.example.com/oauth2/callback&
 response_type=code&
 client_id=812741506391&
 state=af0ifjsldkj HTTP/1.1 302 Found
 Location: https://app.example.com/oauth2/callback?
 code=MsCeLvIaQm6bTrgtp7&
 state=af0ifjsldkj Request Response Note: Parameters are not URL-encoded for example purposes
  • 66. Token Request POST /oauth2/v3/token HTTP/1.1 Host: www.googleapis.com Content-Type: application/x-www-form-urlencoded code=MsCeLvIaQm6bTrgtp7& client_id=812741506391& client_secret={client_secret}& redirect_uri=https://app.example.com/oauth2/callback& grant_type=authorization_code Note: Parameters are not URL-encoded for example purposes
  • 67. Token Response { "access_token": "2YotnFZFEjr1zCsicMWpAA", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "tGzv3JOkF0XG5Qx2TlKWIA", "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjFlOWdkazcifQ..." }
  • 68. Validate ID Token Token Endpoint Authorization Endpoint /.well-known/
 openid-configuration JWKS Endpoint UserInfo Endpoint OAuth 2.0 Authorization Server & OpenID Connect Provider (OP) OAuth 2.0 Resource Server Client (Relying Party) 1 3 2 54 1 Discover OpenID Provider Metadata 2 Perform OAuth flow to obtain a ID token and/or access token 3 Get JSON Web Key Set (JWKS) for signature keys 4 Validate ID token
 (JSON Web Token) 5 Get additional user attributes with access token from UserInfo endpoint OpenID Connect
  • 70. Okta OpenID Connect Integrates with Okta Authentication API for branded Sign-In UX Certified for the following conformance profiles: OP Basic OP Implicit OP Hybrid OP Config
  • 71. Sign-In Widget and JS Auth SDK 71 Open-source embeddable widget for end-to-end sign-in flow with MFA and account recovery Returns an ID Token for authenticated user Supports social authentication providers Built-on common JS Auth SDK Open source: https://github.com/okta/okta-signin- widget
  • 72. Sign-In Widget and JS Auth SDK Wraps Okta authentication and session management APIs in JS callbacks for custom UX Implements custom web messaging OAuth 2.0 response mode (okta-post- message) for single page applications with hidden iframe Open source: https://github.com/okta/okta-auth-js authClient.signIn({ username: 'some-username', password: 'some-password' }) .then(function(transaction) { if (transaction.status === 'SUCCESS') { authClient.session.setCookieAndRedirect(transaction.sessionToken); } });
  • 73. Google OAuth Client Library ScribeJava Spring Security OAuth Nimbus OAuth SDK List of client and server libraries for many languages: https://oauth.net/code/ OAuth and OIDC Libraries
  • 75. OAuth Specification oauth.net OAuth 2.0 Servers oauth.com Additional Resources