API Security and OAuth for the Enterprise

A Practical Guide to API Security and OAuth

for the Enterprise K. Scott Morrison

CTO and Chief Architect

Layer 7 Technologies, Inc.

Eve Maler

Principal Analyst

Forrester Research, Inc.

Layer 7 Confidential 2

Housekeeping

Questions

- Chat any questions you have and we’ll answer them at the end of this call

Twitter

- Today’s event hashtag:

- #L7webinar

- Follow us on Twitter as well:

- @KScottMorrison

- @xmlgrrl

- @layer7

- @forrester

facebook.com/layer7

layer7.com/blogs

layer7.com/linkedin



© 2009 Forrester Research, Inc. Reproduction Prohibited

OAuth As A Serious API Security Tool

For Enterprises: A Practical Overview Eve Maler, Principal Analyst


“API economy” technologies and

habits are trickling down into the

enterprise.

Leverage OAuth’s strengths for modern

service and app security scenarios while

steering clear of its dangers.


Web services are opening up — and paying a security price.

OAuth is a powerhouse of API security and SSO solutions.

Leverage OAuth’s ascendance while minding its weaknesses.

Agenda


Web APIs aren’t toys; they’re business-enabling tools for

retail, content delivery, financial transactions . . .


Security pros’ control over developers diminishes with

distance


A variety of pressures make traditional security and

access control methods less viable





Agenda


Web 2.0 players originally invented OAuth simply

to solve the ―password antipattern‖


At base, OAuth lets a person delegate constrained

access from one app to another

Source: July 13, 2011, “Protecting Enterprise APIs With A Light Touch” Forrester report


Using the OAuth approach helps manage risk, cost, and

complexity in environments that need Zero Trust

Gets client apps out of the business of storing passwords

Allows for a variety of user authentication methods

Allows app access to be tracked and revoked on a per-client basis

Allows for least-privilege access to API features

Can capture explicit user authorization for access

Lowers the cost of secure app development

Bonus: solves a much larger class of needs around security, identity, access,

and privacy


In consumer-facing scenarios, services can audit who

made each API call on whose behalf

Third parties offer

productivity apps to

eBay sellers that list

items and do other

tasks through the eBay

API

These apps never see

the seller’s eBay

credentials

They don’t merely

“impersonate” the seller



In extranet and SaaS integration scenarios, services can

consume SAML

Partner apps integrate

with the construction

firm’s valve-design

service

On-site partner

engineers log in to their

home systems through

a tablet

They can then use

apps that call the

valve-design service

through SAML SSO



OAuth-native SSO is ―off label‖ but popular for

unifying user-present and user-absent experiences



―Two-legged‖ userless A2A scenarios enable uniform

auditing and compliance for low-level services

Including services such

as:

- Calculating sales tax

- Formatting shipping

labels

- Verifying credit card

numbers

- Performing HTML

code checking

Most scenarios

separate these two

server functions






Agenda


Simplicity doesn’t have to equal insecurity — if you use

and insist on good OAuth practices

Establish UX standards

for users’ “consent

ceremonies.”

Use the strongest

protocol options your

ecosystem will tolerate.

If you depend on

password

authentication,

remember you’re not

immune from user

credential-stealing risks

such as phishing.

Store OAuth tokens

and other secrets

securely.

Fully protect the use of

your callback endpoint.

If your use of OAuth

involves cryptographic

algorithms, reuse a

well-tested library.

Server-side Client-side


So how can you maximize value in an

OAuth-enabled future?

Determine which scenarios resonate with your

organization’s needs.

Ask which SaaS providers are in a position to force

your hand.

If you will be publishing your own web APIs, catalog

your client app requirements and constraints.

Partner with enterprise architects to plan how OAuth

token handling and your current SOA infrastructure

need to interact.

Accept some volatility around OAuth’s evolution — and

even embrace it.


In particular, keep an eye on OAuth’s SSO futures

© 2009 Forrester Research, Inc. Reproduction Prohibited

Thank you

Eve Maler

+1 425.345.6756

[email protected]

Twitter: @xmlgrrl

www.forrester.com

A Practical Guide to API Security and OAuth

for the Enterprise K. Scott Morrison

CTO and Chief Architect


First Let’s Nail the Terminology…

Resource Owner

(RO)

(a.k.a., the User)

Client

Authorization

Server (AS)

Resource

Server (RS)


Request Twitter (Client) Access – Facebook (AS)


Authorization Grant – Twitter (Client), Facebook (AS)

Finger of Resource Owner


Authorization Granted – Twitter (Client), Facebook (AS)


API Call (request for Protected Resource)

from Twitter (Client) to Facebook (RS)


Manage Twitter (Client) Access – Facebook (AS)


Manage Flipboard (Client) Access – Facebook (AS)


Comprehensive REST Access Control Needs:

OAuth Clients

Provisioning

Approval Flow

Persistence

Querying

Metrics

OAuth Tokens

Persistence

Querying

Metrics

Revocation

Refresh

OAuth Autz

server

Policy Modeling

OAuth Protocol

Identity integration

Token issuing

Token refresh

SLA enforcement

Prot Res Server

Policy Modeling

Token validation

Bearer, MAC, SAML


Integrity check

API proxying

SLA enforcement

Analytics

Reports

Monitoring

SLAs

Alerting

*all of this*


The Layer 7 OAuth Toolkit Provides:

OAuth Clients

Provisioning

Approval Flow

Persistence

Querying

Metrics

OAuth Tokens

Persistence

Querying

Metrics

Revocation

Refresh

OAuth Autz

server

Policy Modeling

OAuth Protocol


Token issuing

Token refresh

SLA enforcement

Prot Res Server

Policy Modeling

Token validation

Bearer, MAC, SAML


Integrity check

API proxying

SLA enforcement

Analytics

Reports

Monitoring

SLAs

Alerting

Omg, it’s full of win

*all of this*


Today’s Demo

Resource Owner

(RO)

(a.k.a., the User)

Client

Authorization

Server (AS)

Resource

Server (RS)

Get Recipe


Demo

To View the Demo, Download a

Recording of This Webinar in

Layer 7 Resource Library

Layer7.com/library

Technology

API Security and OAuth for the Enterprise