Introduc)on to OAuth 2 · The OAuth 2.0 authorization framework enables a third-party application...

Introduc)ontoOAuth2.0

Jus)nRicherBespokeEngineering

APIsaremeanttobeused•  Muchofmydataandthefunc)onalityofmylifeisavailablethroughAPIstoday

•  Iwanttohaveapplica)onsaccessmyAPIs•  Idon’twanttheapplica)onstohavetoimpersonateme

•  Idon’twanttosharemykeyswitheveryone

AvaletkeyforAPIs•  Avaletkeygivessomeoneelselimitedaccesstoacar

•  WhatifwecoulddothatforwebAPIs?

OAUTH2.0

Fromthespec(RFC6749)The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf.

ThegoodbitsThe OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf.

InotherwordsOAuth 2.0 is a delegation protocol that lets people allow applications to access things (like APIs) on their behalf.

Whoisinvolved?

Resource Owner Authorization

Server

ProtectedResource

Client

Theresourceowner•  HasaccesstosomeresourceorAPI•  CandelegateaccesstothatresourceorAPI•  Usuallyhasaccesstoawebbrowser•  Usuallyisaperson

Theprotectedresource•  Webservice(API)withsecuritycontrols•  Protectsthingsfortheresourceowner•  Sharesthingsontheresourceowner’srequest

Theclientapplica)on•  Wantstoaccesstheprotectedresource•  Doesthingsontheresourceowner’sbehalf•  Couldbeawebserver– Butit’ss)lla“client”inOAuthparlance– Couldalsobeana)veapporJSapp

Whatarewetryingtosolve?

Resource Owner

The Goal:

Give the client access to the protected

resource on behalf of the resource owner.

ProtectedResource

Client

IntroducingtheAuthoriza)onServer(AS)

Server

ProtectedResource

Client

The Authorization Server gives us a mechanism to bridge the gap between

the client and the protected resource

TheAuthoriza)onServer•  Generatestokensfortheclient•  Authen)catesresourceowners(users)•  Authen)catesclients•  Managesauthoriza)ons

OAuthTokens•  Representgranteddelegatedauthori)es–  Fromtheresourceownertotheclientfortheprotectedresource

•  Issuedbyauthoriza)onserver•  Usedbyclient–  Formatisopaquetoclients

•  Consumedbyprotectedresource

ExampleOAuthTokens•  92d42038006dba95d0c501951ac5b5eb•  2df029c6-b38d-4083-b8d9-db67c774d13f•  eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ

•  waterbuffalo-elephant-helicopter-argument

TheOAuthapproachattheAS•  Clientauthen)catesforitself•  Userauthorizesclienttoactonuser’sbehalf•  Servergeneratesatokentorepresentthatauthoriza)on

•  Clientpresentsthattokentogainaccess

You’veusedOAuth

ThepiecesofOAuth

Resource Owner

Access Token

Authorization Server

ProtectedResource

Client

THEAUTHORIZATIONCODEFLOWAdeepdiveintothecanonicalOAuth2.0transac)on

Theauthoriza)oncodeflow

Server

ProtectedResource

Client

TWOFORMSOFCOMMUNICATION

Thefrontchannel

Server

ProtectedResource

Client

Front channel uses HTTP redirects through the web browser, no direct connections

Thebackchannel

Server

ProtectedResource

Client

Back channel uses direct HTTP connections between components,

the browser is not involved

THEAUTHORIZATIONCODEFLOWStepbystep

Authoriza)onCode:Step1

Server

ProtectedResource

Client

Client redirects the resource owner to the authorization server

Server

ProtectedResource

Client

Resource owner authenticates to the authorization server

Server

ProtectedResource

Client

Resource owner authorizes the client

AlayeredtrustmodelWhitelistInternal partiesKnown business partnersCustomer organizationsTrust frameworks

• Centralized control• Traditional policy management

GreylistUnknown entitiesTrust On First Uuse

• End user decisions• Extensive auditing and logging• Rules on when to move to the

white or black lists

BlacklistKnown bad partiesAttack sites

• Centralized control• Traditional policy management

Server

ProtectedResource

Client

Authorization server redirects resource owner back to the client with an

authorization code

Server

ProtectedResource

Client

Client sends the authorization code back

to the authorization server along with its own

credentials

Server

ProtectedResource

Client

Authorization server issues OAuth token to

the client

Server

ProtectedResource

Client

Client accesses the protected resource using

the access token

Interpre)ngthetoken•  Theclientneverknowsorcareswhat’sinthetokenitself

•  Theresourceserverneedstounderstandwhat’sinthetoken– Whoit’sissuedfor– Whatit’sgoodfor

ThankYou

BACKUPSLIDESHeretherebedragons

OTHERWAYSTODOOAUTH2.0

Theimplicitflow

Server

ProtectedResource

Client Inside the Browser

Implicit grant type uses only the front

channel since the client is inside the browser

Theclientcreden)alsflow

ProtectedResource

Client

Client credentials grant type: Client trades its own credentials for a

token, uses only the back channel since the client is acting on its own behalf

Theresourceownerpasswordflow

Server

ProtectedResource

Client

Resource owner credentials grant type:

Client trades username and password for an OAuth token over the back channel

Theasser)onsflows

Assertion provider

ProtectedResource

Client

Client trades a cryptographically protected element

(assertion) for a token

Differentusecases•  Authoriza)oncodeflow:webapplica)ons,somena)veapplica)ons

•  Implicitflow:in-browserapplica)ons•  Clientcreden)alsflow:non-interac)ve•  Passwordflow:trustedlegacyclients•  Asser)onflows:trustframeworks

HowtochooseaflowIs the client acting on behalf of a resource

owner?

Is the client running completely inside of a

web browser?

Yes Yes

Can the resource owner interact with a web browser

while using the client?

Does the user have a simple set of credentials

like a password?

Is the client acting on its own behalf?

Authorization Code

Assertion

Resource Owner Credentials

Client Credentials

Implicit

Is the client acting on behalf of a third party

authority?

Choose the appropriate OAuth grant type for

the type of application you’re building

CANWEBUILDAUTHENTICATIONONOAUTH?

Howcanwesplitthenetwork?

Resource Owner

Identity Provider

The security domain

boundary is crossed

ProtectedResource

Security Dom

ain Boundary

Client

Relying Party

OAuthSign-In

Abemerwaytosplitthenetwork

Resource Owner

Identity Provider

ProtectedResource

Client

Security Dom

ain Boundary

Sign-In

Relying Party

The security domain

boundary is preserved

Thatworks!•  We’reusingOAuthtoprotecttheiden)ty•  Theclientconsumestheiden)ty

Authoriza)onisChocolate•  Goodonitsown•  Greataspartofalargerrecipe•  Manydifferentrecipescanuseit

Authen)ca)onisFudge•  Confec)onwithseveralingredients•  Tendstohaveoneflavorasthemostobvious•  Couldbemadeusingchocolate– Butnotrequired

Agreeingonarecipe•  Let’smakearecipeforchocolatefudge:– Standardauthen)ca)onprotocol– Builtontopofstandardauthoriza)onprotocol–  Interoperablecrossdomain

OpenIDConnect•  IdPoffersinterac)veOAuthflows•  IDTokencarriesauthen)ca)oninforma)on– FormamedasaJWT– Audienceistheclient,nottheresource

•  UserInfoEndpoint– Standardsetofclaimsandscopes

USERMANAGEDACCESS

Persontopersondelega)on•  OAuthletsAlicesharewithherself•  UMAletsAlicesharewithBob– Bobisthe“Reques)ngParty(RqP)”toAlice’s“ResourceOwner(RO)”

– Alicecansetpoliciesaheadof)me

UserManagedAccess

Resource Owner

Requesting Party

Protection API Authorization API

ProtectedResource

Client

Wideecosystembenefits•  AlicecanintroduceanewresourcetoherAS•  TheresourceservercanmanageitsaccessusingthisASanditstokens

ReferencebookforOAuth2•  OAuth2InAc+on•  First9chaptersavailabletoday,morecomingsoon

•  Outthisspring/summer

hmps://manning.com/books/oauth-2-in-ac)on

Introduc)on to OAuth 2 · The OAuth 2.0 authorization framework enables a third-party application...

Documents

Oracle OAuth ServiceOAuth 2.0 authorization server and also offers several compelling differentiations to enable the OAuth 2.0 Client and the OAuth 2.0 Resource Server roles. OAM OAuth

[MS-OAPXBC]: OAuth 2.0 Protocol Extensions for …...The OAuth 2.0 Protocol Extensions for Broker Clients specify extensions to [RFC6749] (The OAuth 2.0 Authorization Framework) that

OAuth2.0: the Promise and Pitfalls - Lateral Security · 2019-02-11 · • Section 10 of RFC6749 “The OAuth 2.0 Authorization Framework”. (7 pages out of 75) • RFC6819 “OAuth

RFC 6749 - The OAuth 2.0 Authorization Framework...The OAuth 2.0 Authorization Framework Abstract The OAuth 2.0 authorization framework enables a third-party application to obtain

CHRISTIAN KELLER CLOUD NATIVE APPS SICHERN MIT OAUTH … fileCLOUD NATIVE APPS SICHERN MIT OAUTH 2/OPENID CONNECT GLIEDERUNG OAuth 2.0 - Flows Authorization Code Grant Implicit Grant

OAuth Guide Release 6 - Oracle Preface This guide explains how to use the Open Authorization Protocol (OAuth) features with Oracle Communications Services Gatekeeper. Audience

The OAuth 2.0 Authorization for the Internet of Things · PDF file Thesis Title: The OAuth 2.0 Authorization for the Internet of Things Description of the units: The Networked Embedded

Authentication in the Cloud€¦ · OAuth 2.0 Obtaining authorization (access/refresh token) Authorization code – Server-side webapp Implicit grant – JavaScript app – Access

Measuring and Mitigating OAuth Access Token Abuse by … · 2017-10-18 · Facebook implements OAuth 2.0 authorization frame-work [30] which allows third-party applications to gain

The OAuth 2.0 Authorization Frameworkself-issued.info/docs/draft-ietf-oauth-v2-30.pdf · 2012. 7. 15. · The OAuth 2.0 Authorization Framework draft-ietf-oauth-v2-30 Abstract The

OAuth 2.0 Proof-of-Possession: Authorization Server to ......OAuth 2.0 Proof-of-Possession: Authorization Server to Client Key Distribution draft-bradley-oauth-pop-key-distribution-01.txt

OAuth and OpenID Connect · OAuth 2.0 authorization code flow yelp.com Connect with Google Redirect URI: accounts.google.com Email Password accounts.google.com Allow Yelp to access

Oauth (Open Authorization)

The OAuth 2.0 Authorization Framework

Mastering OAuth 2 - Adobe Inc.€¦ · leveraging the OAuth 2.0 Authorization Framework Mastering OAuth 2.0 Charles Bihis Mastering OAuth 2.0 OAuth 2.0 is a powerful authorization

Authorization for Internet of Things using OAuth 2.0

CHAPTER 4 OAUTH€¦ · 2 OBJECTIVES After completing “OAuth,” you will be able to: Identify issues of authorization for RESTful services. Explain the OAuth standard for establishing

Introduction to OpenID Connect - self-issued.infoself-issued.info/presentations/OpenID_Connect... · •OAuth 2.0 Form Post Response Mode –Defines how to return OAuth 2.0 Authorization

[MS-OAPX]: OAuth 2.0 Protocol Extensions... · 1 Introduction The OAuth 2.0 Protocol Extensions specify extensions to [RFC6749] (The OAuth 2.0 Authorization Framework). When no operating

The OAuth 2.0 Authorization Protocol - cleesh.com · The OAuth 2.0 Authorization Protocol draft-ietf-oauth-v2-25 Abstract The OAuth 2.0 authorization protocol enables a third-party