OpenID Connect - a simple[sic] single sign-on & identity layer on top of OAuth 2.0

OpenID Connect
a simple[sic] single sign-on & identity
layer on top of OAuth 2.0
Brian Campbell
@__b_c
Copyright © 2014 Brian Campbell. All rights reserved.

Copyright © 2014 Brian Campbell. All rights reserved. 2
Agenda
• Introductions
• Framing the Problem
• OpenID Connect as an Emergent Solution
• Nuts & Bolts: The Basic Client Profile
• Random Thoughts

Who Dat?
Brian Campbell
Some Meaningless Title & 10+ years @
Used to write a lot of code
Now active in standards development
Identity is ubiquitous. Regardless of the kind of applications you develop you will, at some point, almost certainly have to deal with identifying
users of the app. Yet it's seldom a central part of the app’s value proposition and rarely a core competency for developers. Wouldn’t it be nice to
outsource user authentication and free yourself from the liability and complexity of storing and managing passwords? OpenID Connect, just
ratified earlier this year and backed by some big industry names, is emerging as the go to standard way to do exactly that. Connect allows you to
easily and securely get an answer to the question: “What is the identity of the person currently using this browser or native app?” Unlike some of
it’s predecessors, however, Connect has roots spanning the consumer, SaaS and enterprise space and is better suited to serve a diverse set of
deployments. Come find out more about Connect in this talk from a seasoned veteran of the prestigious basement conference rooms at GlueCon.
Cardboard box

Speaker Credentials

Speaker Credentials
Prominently mentioned
on the second to last
page that nobody will
ever read just before
the copyright notices

Agenda
• Introductions
• Random Thoughts

Passwords are Broken For Users
Death by a Thousand Passwords
true story: “holyfucknotanotherfuckingpassword1”

Passwords are Broken For Users
What?
A Well Regarded Fortune 500 Financial Services Company

Passwords also Broken for
Service Providers
• Hell on user registration
conversion rates
• Managing passwords is
hard
– Just ask Adobe or LinkedIn
or Kickstarter or…

Agenda
• Introductions
• Random Thoughts

Introducing OpenID Connect
• Easily and securely get an answer to the question:
“What is the identity of the person currently
using this browser or native app?”
– Without taking on the responsibility of storing and
managing passwords, which is nice
• Built on top of OAuth 2.0 using familiar and
widely available stuff like JSON and HTTP
• Adds an ID Token (JWT) for user authentication to
the client
• API access and SSO together

Unlike Predecessors

OAuth 2.0 In A Nutshell
Client
Resource
Server
Authorization
Server
Authorization
Endpoint
Token
Endpoint
Important Stuff
Where the
magic
happens

OAuth 2.0
JOSE WebFinger
OpenID
Connect

OpenID Connect is built on OAuth 2.0
Discovery
Client
Relying Party
Resource
Server
Authorization
Server
Identity Provider or
IDP or
OpenID Provider or
OP
Authorization
Endpoint
Token
Endpoint
Important Stuff
Userinfo
Endpoint
Registration
Endpoint
JWKS
Endpoint
JWKS
Endpoint
Validate
(JWT)
ID Token
/.well-known
/webfinger
/openid-configuration
Check Session IFrame
End Session Endpoint

Didn’t Someone Say “Simple”?
• It wasn’t me
• It’s not simple, it’s complicated
• But the burden of complexity has been shifted
to the Identity Provider, where it’s more
appropriate
• Many deployments can be à la carte
Mr. Boombastic
https://www.flickr.com/photos/67589493@N00/166195826
(cropped)
https://creativecommons.org/licenses/by/2.0/

Agenda
• Introductions
• Random Thoughts

Basic Client
• OpenID Connect Basic Client Implementer's
Guide 1.0
– http://openid.net/specs/openid-connect-basic-1_0.html
• “a subset of the OpenID Connect Core 1.0
specification that is designed to be easy to
read and implement for basic Web-based
Relying Parties using the OAuth Authorization
Code Flow.”

Basic Client Flow
End-User /
Browser
Client Auth Server
Redirect w/ Authentication Request
Authentication Request

Basic Client Flow
End-User /
Browser
Client Auth Server
https://connect-interop.pinglabs.org:9031/as/authorization.oauth2?
client_id=some-client-identifier&
response_type=code&
scope=openid profile email address phone&
state=meh234&
redirect_uri=https://client.example.io/cb
not encoded for
readability

Basic Client Flow
End-User /
Browser
Client Auth Server
Authenticate End-User

Basic Client Flow
End-User /
Browser
Client Auth Server

Basic Client Flow
End-User /
Browser
Client Auth Server
Obtain User Consent

Basic Client Flow
End-User /
Browser
Client Auth Server
Obtain User Consent
Redirect w/ Authentication Response
Authentication Response w/ code

Basic Client Flow
End-User /
Browser
Client Auth Server
Obtain User Consent
https://client.example.io/cb?
state=meh234&
code=JbXAZUzro_ka3htpQSePwxOMjTfQX8RxmRELgiP1

Basic Client Flow
End-User /
Browser
Client Auth Server
Obtain User Consent
Token Request w/ code

Basic Client Flow
End-User /
Browser
Client Auth Server
Obtain User Consent
POST /as/token.oauth2 HTTP/1.1
Host: connect-interop.pinglabs.org:9031
Content-Length: 185
Content-Type: application/x-www-form-urlencoded
client_id=some-client-identifier&
grant_type=authorization_code&
client_secret=super-duper-password&
redirect_uri=https://client.example.io/cb&
code=JbXAZUzro_ka3htpQSePwxOMjTfQX8RxmRELgiP1
not encoded for
readability

Basic Client Flow
End-User /
Browser
Client Auth Server
Obtain User Consent
Token Response w/ access & ID token

Basic Client Flow
End-User /
Browser
Client Auth Server
Obtain User Consent
HTTP/1.1 200 OK
Date: Tue, 13 May 2014 15:43:14 GMT
Cache-Control: no-cache, no-store
Pragma: no-cache
max-age: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: application/json;charset=UTF-8
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Transfer-Encoding: chunked
{"token_type":"Bearer",
"expires_in":600,
"id_token":"eyJhbGciOiJub25lIn0.eyJzdWIiOiIxMDAxIiwiYXVkIjoic
29tZS1jbGllbnQtaWRlbnRpZmllciIsImp0aSI6Ijc2UnJHdkM1bDNRT
1BPMDVwTGpVdmEiLCJpc3MiOiJodHRwczpcL1wvY29ubmVjdC1p
bnRlcm9wLnBpbmdsYWJzLm9yZzo5MDMxIiwiaWF0IjoxMzk5OTk
1Nzg1LCJleHAiOjEzOTk5OTYzODV9.",
"access_token":"zfrQZYtamGHS6ZYXdSV4Yo"}

Basic Client Flow
End-User /
Browser
Client Auth Server
Obtain User Consent
eyJhbGciOiJub25lIn0.
eyJzdWIiOiIxMDAxIiwiYXVkIjoic29tZS1jbGllbnQtaWRlbnRpZmllciI
sImp0aSI6Ijc2UnJHdkM1bDNRT1BPMDVwTGpVdmEiLCJpc3MiOiJ
odHRwczpcL1wvY29ubmVjdC1pbnRlcm9wLnBpbmdsYWJzLm9yZ
zo5MDMxIiwiaWF0IjoxMzk5OTk1Nzg1LCJleHAiOjEzOTk5OTYzOD
V9.
{"alg":"none”}
{"sub":"1001",
"aud":"some-client-identifier",
"jti":"76RrGvC5l3QOPO05pLjUva",
"iss":"https://connect-interop.pinglabs.org:9031",
"iat":1399995785,
"exp":1399996385}

Basic Client Flow
End-User /
Browser
Client Auth Server
Obtain User Consent
User Info Request w/ access token

Basic Client Flow
End-User /
Browser
Client Auth Server
Obtain User Consent
GET /idp/userinfo.openid HTTP/1.1
Host: connect-interop.pinglabs.org:9031
Accept: */*
Authorization: Bearer zfrQZYtamGHS6ZYXdSV4Yo

Basic Client Flow
End-User /
Browser
Client Auth Server
Obtain User Consent
User Info Response

Basic Client Flow
End-User /
Browser
Client Auth Server
Obtain User Consent
User Info Response
HTTP/1.1 200 OK
Date: Tue, 13 May 2014 15:44:13 GMT
Content-Type: application/json;charset=UTF-8
{"sub": "1001",
"name": "Joe Doe",
"given_name": "Joe",
"family_name": "Doe",
"preferred_username": "joe",
"email": "joe.doe@pinglabs.org",
"picture": "http://farm8.staticflickr.com/7224/7395022014_1f6f3b33c8_m.jpg",
"address":{"formatted":"1234 South North Street, Amherst, MA 01002"},
"phone_number":"+1 (413) 867-5309"}

That was Simple?
• There are a lot of lines…
• But from the Client’s perspective
– Send the user off somewhere
– Wait for them to show up on a callback
– Make two simple HTTPS calls and validate some
data
– Done

Agenda
• Introductions
• Random Thoughts

It’s Not All Rainbows & Unicorns
• SAML’s IDP initiated POST is easily the most
successful SSO deployment for the enterprise market
• Some impedance mismatch as Connect doesn’t have
straightforward equivalents

Tweet Bait
https://twitter.com/cloud_opinion/status/459481058480648193
one
picture
of a
goat

I’m Done.

OpenID Connect - a simple[sic] single sign-on & identity layer on top of OAuth 2.0

More Related Content

What's hot (20)

Viewers also liked (9)

Similar to OpenID Connect - a simple[sic] single sign-on & identity layer on top of OAuth 2.0 (20)

More from Brian Campbell (13)

Recently uploaded (20)

OpenID Connect - a simple[sic] single sign-on & identity layer on top of OAuth 2.0