OAuth & OpenID Connect Deep Dive
Download as PDF, PPTX5 likes1,856 views
The document provides an in-depth overview of OAuth and OpenID Connect, including terminology, common flows, and advanced specifications. It discusses different types of tokens, their usage, and highlights the importance of scopes within the protocol. Additionally, it addresses improper and proper uses of OAuth and outlines advanced security measures such as PKCE and mutual TLS.
More Related Content
Similar to OAuth & OpenID Connect Deep Dive (20)
More from Nordic APIs (20)
OAuth & OpenID Connect Deep Dive
- 1. OAuth & OpenID Connect Deep Dive Copyright © 2018 Curity AB By Travis Spencer, CEO @travisspencer, @curityio
- 2. Agenda Terminology & some basics Common flows Some more advanced, related specs @travis / @curityio Copyright © 2018 Curity AB
- 3. Framework for other specifications Request tokens from a token server Present them to an API Allows delegated access, revocation, no password sharing Obsoletes OAuth 1.0a @travis / @curityio Copyright © 2018 Curity AB
- 4. OAuth Actors 1. Resource Owner (RO) 2. Client 3. Authorization Server (AS) 4. Resource Server (RS) (i.e., API) Get a token Use a token @travis / @curityio Copyright © 2018 Curity AB
- 5. Request, Authenticate & Consent Request Access Login Consent @travis / @curityio Copyright © 2018 Curity AB
- 6. User is redirected to OAuth server Code Flow APIs & microservices @travis / @curityio Copyright © 2018 Curity AB
- 7. User logs in and delegates access Code Flow APIs & microservices @travis / @curityio Copyright © 2018 Curity AB
- 8. Code Flow Short-lived access code is issued to client APIs & microservices @travis / @curityio Copyright © 2018 Curity AB
- 9. Code Flow Code is exchanged for an access token APIs & microservices @travis / @curityio Copyright © 2018 Curity AB
- 10. Code Flow Access token can be used to call APIs APIs & microservices @travis / @curityio Copyright © 2018 Curity AB
- 11. Scopes • Like permissions • Scopes specify extent of tokens’ usefulness • Listed on consent UI (if shown) • No standardized scopes @travis / @curityio Copyright © 2018 Curity AB
- 12. Kinds of Tokens Like a session Refresh TokensAccess Tokens Like a Password Used to secure API calls Used to get new access tokens @travis / @curityio Copyright © 2018 Curity AB
- 13. Profiles of Tokens Holder of Key HoK tokens are like credit cards Bearer Bearer tokens are like cash $ @travis / @curityio Copyright © 2018 Curity AB
- 14. Types of Tokens • WS-Security & SAML • Custom • Home-grown • Oracle Access Manager • SiteMinder • CBOR Web Tokens (CWT) • JWT @travis / @curityio Copyright © 2018 Curity AB
- 15. JWT = JWS/E/K/A@travis / @curityio Copyright © 2018 Curity AB
- 16. JWT Type Tokens • Pronounced like the English word “jot” • Lightweight tokens passed in HTTP headers & query strings • Encoded as JSON • Compact • Encrypted, signed, or neither • Not the only kind of token allowed by OAuth @travis / @curityio Copyright © 2018 Curity AB
- 17. Passing Tokens By Value User attributes are in the token By Reference User attributes are referenced by an identifier @travis / @curityio Copyright © 2018 Curity AB
- 18. Improper Usage of OAuth Not for authentication Not for federation Not really for authorization @travis / @curityio Copyright © 2018 Curity AB
- 19. Proper Usage or OAuth For delegation @travis / @curityio Copyright © 2018 Curity AB
- 20. Profiles: Basic, Implicit, Hybrid flow, FAPI Form POST response model Dynamic client registration Logout Session management Discovery @travis / @curityio Copyright © 2018 Curity AB
- 21. Copyright Curity AB 2017 OIDC & OAuth versions WebFinger Well-known URIs Discovery Metadata Copyright Curity AB 2017
- 22. OpenID Connect Examples Get user info using access token OAuth AS / OpenID Provider RP / Client Browser Access code Send code to get access token Access token & ID token Check audience restriction of ID token Request login, providing “openid” scope & user info scopes User info @travis / @curityio Copyright © 2018 Curity AB
- 23. ID Token is for the Client • Access token is for API • ID token is for client • ID token provides client with info about • Intended client recipient • Username • Credential used to login • Issuer of token • Expiration time @travis / @curityio Copyright © 2018 Curity AB
- 24. User Info Endpoint • Token issuance and user discovery endpoint • Authenticate using access token issued by OpenID Provider • Output depends on requested and authorized scopes • sub claim must match sub claim in ID token @travis / @curityio Copyright © 2018 Curity AB
- 25. For High Security PoP Token binding Proof Key for Code Exchange (PKCE or “pixie”) Mutual TLS Profile for OAuth @travis / @curityio Copyright © 2018 Curity AB
- 26. Around 50 RFCs, drafts & other specs 26 Hopefully this has been a helpful overview to start digging deeper @travis / @curityio Copyright © 2018 Curity AB
- 27. Visit curity.io and stop by our booth @travis / @curityio Copyright © 2018 Curity AB