introduc)on to oauth 2 · the oauth 2.0 authorization framework enables a third-party application...

Introduc)ontoOAuth2.0

Jus)nRicherBespokeEngineering

1

©2016BespokeEngineeringLLC

APIsaremeanttobeused•  Muchofmydataandthefunc)onalityofmylifeisavailablethroughAPIstoday

•  Iwanttohaveapplica)onsaccessmyAPIs•  Idon’twanttheapplica)onstohavetoimpersonateme

•  Idon’twanttosharemykeyswitheveryone


2

AvaletkeyforAPIs•  Avaletkeygivessomeoneelselimitedaccesstoacar

•  WhatifwecoulddothatforwebAPIs?


3

OAUTH2.0

4


Fromthespec(RFC6749)The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf.

5


ThegoodbitsThe OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf.

6


InotherwordsOAuth 2.0 is a delegation protocol that lets people allow applications to access things (like APIs) on their behalf.

7


Whoisinvolved?

Resource Owner Authorization

Server

ProtectedResource

Client

8


Theresourceowner•  HasaccesstosomeresourceorAPI•  CandelegateaccesstothatresourceorAPI•  Usuallyhasaccesstoawebbrowser•  Usuallyisaperson

9


Theprotectedresource•  Webservice(API)withsecuritycontrols•  Protectsthingsfortheresourceowner•  Sharesthingsontheresourceowner’srequest

10


Theclientapplica)on•  Wantstoaccesstheprotectedresource•  Doesthingsontheresourceowner’sbehalf•  Couldbeawebserver– Butit’ss)lla“client”inOAuthparlance– Couldalsobeana)veapporJSapp

11


Whatarewetryingtosolve?

Resource Owner

The Goal:

Give the client access to the protected

resource on behalf of the resource owner.

ProtectedResource

Client

12


IntroducingtheAuthoriza)onServer(AS)


Server

ProtectedResource

Client

The Authorization Server gives us a mechanism to bridge the gap between

the client and the protected resource

13


TheAuthoriza)onServer•  Generatestokensfortheclient•  Authen)catesresourceowners(users)•  Authen)catesclients•  Managesauthoriza)ons

14


OAuthTokens•  Representgranteddelegatedauthori)es–  Fromtheresourceownertotheclientfortheprotectedresource

•  Issuedbyauthoriza)onserver•  Usedbyclient–  Formatisopaquetoclients

•  Consumedbyprotectedresource

15


ExampleOAuthTokens•  92d42038006dba95d0c501951ac5b5eb•  2df029c6-b38d-4083-b8d9-db67c774d13f•  eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ

•  waterbuffalo-elephant-helicopter-argument

16


TheOAuthapproachattheAS•  Clientauthen)catesforitself•  Userauthorizesclienttoactonuser’sbehalf•  Servergeneratesatokentorepresentthatauthoriza)on

•  Clientpresentsthattokentogainaccess

17


You’veusedOAuth

18


ThepiecesofOAuth

Resource Owner

Access Token

Authorization Server

ProtectedResource

Client

19


THEAUTHORIZATIONCODEFLOWAdeepdiveintothecanonicalOAuth2.0transac)on

20


Theauthoriza)oncodeflow


Server

ProtectedResource

Client

21


TWOFORMSOFCOMMUNICATION

22


Thefrontchannel


Server

ProtectedResource

Client

Front channel uses HTTP redirects through the web browser, no direct connections

23


Thebackchannel


Server

ProtectedResource

Client

Back channel uses direct HTTP connections between components,

the browser is not involved

24


THEAUTHORIZATIONCODEFLOWStepbystep

25


Authoriza)onCode:Step1


Server

ProtectedResource

Client

Client redirects the resource owner to the authorization server

26




Server

ProtectedResource

Client

Resource owner authenticates to the authorization server

27




Server

ProtectedResource

Client

Resource owner authorizes the client

?

28


AlayeredtrustmodelWhitelistInternal partiesKnown business partnersCustomer organizationsTrust frameworks

• Centralized control• Traditional policy management

GreylistUnknown entitiesTrust On First Uuse

• End user decisions• Extensive auditing and logging• Rules on when to move to the

white or black lists

BlacklistKnown bad partiesAttack sites

• Centralized control• Traditional policy management

29




Server

ProtectedResource

Client

Authorization server redirects resource owner back to the client with an

authorization code

30




Server

ProtectedResource

Client

Client sends the authorization code back

to the authorization server along with its own

credentials

31




Server

ProtectedResource

Client

Authorization server issues OAuth token to

the client

32




Server

ProtectedResource

Client

Client accesses the protected resource using

the access token

33


Interpre)ngthetoken•  Theclientneverknowsorcareswhat’sinthetokenitself

•  Theresourceserverneedstounderstandwhat’sinthetoken– Whoit’sissuedfor– Whatit’sgoodfor

34


ThankYou


35

BACKUPSLIDESHeretherebedragons


36

OTHERWAYSTODOOAUTH2.0

37


Theimplicitflow


Server

ProtectedResource

Client Inside the Browser

Implicit grant type uses only the front

channel since the client is inside the browser

38


Theclientcreden)alsflow


ProtectedResource

Client

Client credentials grant type: Client trades its own credentials for a

token, uses only the back channel since the client is acting on its own behalf

39


Theresourceownerpasswordflow


Server

ProtectedResource

Client

?

Resource owner credentials grant type:

Client trades username and password for an OAuth token over the back channel

40


Theasser)onsflows


Assertion provider

ProtectedResource

Client

Client trades a cryptographically protected element

(assertion) for a token

41


Differentusecases•  Authoriza)oncodeflow:webapplica)ons,somena)veapplica)ons

•  Implicitflow:in-browserapplica)ons•  Clientcreden)alsflow:non-interac)ve•  Passwordflow:trustedlegacyclients•  Asser)onflows:trustframeworks

42


HowtochooseaflowIs the client acting on behalf of a resource

owner?

Is the client running completely inside of a

web browser?

Yes

Yes

Yes

Yes

Yes Yes

No

No

NoNo

Can the resource owner interact with a web browser

while using the client?

Does the user have a simple set of credentials

like a password?

Is the client acting on its own behalf?

Authorization Code

Assertion

Resource Owner Credentials

Client Credentials

Implicit

Is the client acting on behalf of a third party

authority?

Choose the appropriate OAuth grant type for

the type of application you’re building

43


CANWEBUILDAUTHENTICATIONONOAUTH?

44


Howcanwesplitthenetwork?

Resource Owner

User


Identity Provider

The security domain

boundary is crossed

ProtectedResource

Security Dom

ain Boundary

Client

Relying Party

OAuthSign-In

45


Abemerwaytosplitthenetwork

Resource Owner

User


Identity Provider

ProtectedResource

Client

+

OAuth

Security Dom

ain Boundary

Sign-In

Relying Party

The security domain

boundary is preserved

46


Thatworks!•  We’reusingOAuthtoprotecttheiden)ty•  Theclientconsumestheiden)ty


47

Authoriza)onisChocolate•  Goodonitsown•  Greataspartofalargerrecipe•  Manydifferentrecipescanuseit

48


Authen)ca)onisFudge•  Confec)onwithseveralingredients•  Tendstohaveoneflavorasthemostobvious•  Couldbemadeusingchocolate– Butnotrequired

49


Agreeingonarecipe•  Let’smakearecipeforchocolatefudge:– Standardauthen)ca)onprotocol– Builtontopofstandardauthoriza)onprotocol–  Interoperablecrossdomain

50


OpenIDConnect•  IdPoffersinterac)veOAuthflows•  IDTokencarriesauthen)ca)oninforma)on– FormamedasaJWT– Audienceistheclient,nottheresource

•  UserInfoEndpoint– Standardsetofclaimsandscopes

51


USERMANAGEDACCESS

52


Persontopersondelega)on•  OAuthletsAlicesharewithherself•  UMAletsAlicesharewithBob– Bobisthe“Reques)ngParty(RqP)”toAlice’s“ResourceOwner(RO)”

– Alicecansetpoliciesaheadof)me

53


UserManagedAccess

Resource Owner

Requesting Party


Protection API Authorization API

ProtectedResource

Client


54

Wideecosystembenefits•  AlicecanintroduceanewresourcetoherAS•  TheresourceservercanmanageitsaccessusingthisASanditstokens

55


ReferencebookforOAuth2•  OAuth2InAc+on•  First9chaptersavailabletoday,morecomingsoon

•  Outthisspring/summer

56


hmps://manning.com/books/oauth-2-in-ac)on

introduc)on to oauth 2 · the oauth 2.0 authorization framework enables a third-party application...

Documents