OAuth with OAuth.io : solving the OAuth Fragmentation for Identity Management on the Web
Upcoming SlideShare
Loading in...5
×
 

OAuth with OAuth.io : solving the OAuth Fragmentation for Identity Management on the Web

on

  • 3,574 views

This talk is about the story of password and identity management on the web. ...

This talk is about the story of password and identity management on the web.
It make an overview about passwod handling, single sign-on solution, OAuth and the future of it for the web, thanks Mozilla Persona and Docker.io Linux Containers.
It also present OAuth.io , a solution to solve framgementation.

Statistics

Views

Total Views
3,574
Views on SlideShare
3,249
Embed Views
325

Actions

Likes
8
Downloads
17
Comments
0

2 Embeds 325

http://www.scoop.it 254
https://twitter.com 71

Accessibility

Categories

Upload Details

Uploaded via as Adobe PDF

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

OAuth with OAuth.io : solving the OAuth Fragmentation for Identity Management on the Web   OAuth with OAuth.io : solving the OAuth Fragmentation for Identity Management on the Web Presentation Transcript

  • From authentication to identity management Mehdi Medjaoui
  • Mehdi Medjaoui @medjawi webshell.io oauth.io
  • Authentication View slide
  • Bob View slide
  • I want to upload my photos to access them from anywhere
  • Photo.service
  • Photo.service Hi Photo. service!
  • Photo.service Hi! Who is it?
  • Photo.service I’m Bob
  • Photo.service Prove it!
  • Photo.service Here’s my secret: ...
  • Photo.service Oh it’s you Bob!
  • Photo.service
  • Photo.service
  • Here’s my secret: ...
  • Here’s my password
  • Why passwords?
  • Identification
  • Authentication = Identification + Verification
  • To correctly verify someone, a secret must relate to: - what they know - what they have - what they are - what they can do
  • But why passwords???
  • In theory
  • Security vs Convenience
  • Photo.service
  • Photo.service Music.service
  • Photo.service Music.service
  • Photo.service Social.service Music.service Video.service Email.service
  • Photo.service Social.service Photo.service Social.service Photo.service Social.service Music.service Email.service Video.service Music.service Email.service Video.service Music.service Video.service Email.service
  • Got cloudy these days...
  • Multiplication of web services have made passwords - hard to remember if unique
  • Multiplication of web services have made passwords - hard to remember if unique - annoying to type all day if strong
  • password hell
  • Multiplication of web services have made passwords - hard to remember if unique - annoying to type all day if strong - weak if not unique
  • Passwords (even strong) do not scale with a growing number of services
  • Solution = Password manager ?
  • simple interface design
  • Single Sign-On
  • Single Sign-On Single sign-on (SSO) is a property of access control of multiple related, but independent software systems.
  • The promise of SSO: - UX with frictionless sign in and higher conversion - Reduced IT costs - Retrieving data with user’s consent but without annoying forms - Reduced password leak risks
  • - SAML - OpenID - Facebook connect - OAuth - Persona
  • IDP Identity provider Photo.service I’m Bob from IDP
  • Is it really Bob? Photo.service IDP Identity provider
  • IDP Identity provider Photo.service Prove to me you’re Bob!
  • IDP Identity provider Photo.service Here’s my session / password
  • IDP Identity provider Photo.service You’re good
  • He’s indeed Bob. Photo.service IDP Identity provider
  • Hi Bob! Gimme fotoz! Photo.service IDP Identity provider
  • Google myspace Yahoo Photo.service ? The user makes the choice
  • - Based on URLs for personal data http://google.com/profiles/me username.wordpress.com blogname.blogspot.com www.myspace.com/username
  • Authorization
  • I want to print my photos from photo. service with printer. service
  • The wrong way:
  • Photo.service has Resource Printer.service needs Resource Key to photo. service
  • Photo.service has Resource Printer.service needs Resource Hi, I want to print my photos.
  • Photo.service credentials? Printer.service needs Resource Photo.service has Resource
  • Photo.service has Resource Printer.service needs Resource Sure:
  • Hi I’m Bob & I have the key Printer.service needs Resource Photo.service has Resource
  • You’re indeed Bob. Printer.service needs Resource Photo.service has Resource
  • Please send me these photos Printer.service needs Resource Photo.service has Resource
  • Here you go Printer.service needs Resource Photo.service has Resource
  • I printed the photos. Printer.service needs Resource Photo.service has Resource
  • I’m gonna look at all of Bob’s photos! Rogue Printer. service needs Resource Photo.service has Resource
  • without his consent... Rogue Printer. service needs Resource Photo.service has Resource
  • Never give your password to other services
  • Authorization is the solution
  • 2008
  • Facebook has Resource some.service needs resource
  • Photo.service has Resource Printer.service needs Resource Key to photo. service
  • Photo.service has Resource Printer.service needs Resource Hi, I’m Bob.
  • I have support for Photo. service, ... Printer.service needs Resource Photo.service has Resource
  • I have support for Photo. service, ... Printer.service needs Resource Photo.service has Resource Note: choice of supported resource providers has also to be made by printer. service
  • Photo.service has Resource Printer.service needs Resource Please use Photo.service
  • Hi, I’m Printer. service Printer.service needs Resource Photo.service has Resource
  • Prove it! Printer.service needs Resource Photo.service has Resource
  • Here’s my client_secret Printer.service needs Resource Photo.service has Resource
  • You’re good. Printer.service needs Resource Photo.service has Resource
  • I need access to Bob’s photos Printer.service needs Resource Photo.service has Resource
  • Photo.service has Resource Printer.service needs Resource Who are you?
  • Photo.service has Resource Printer.service needs Resource I’m Bob. Here’ s my key
  • Photo.service has Resource Printer.service needs Resource Do you allow Pr.S. to access your photos?
  • Photo.service has Resource Printer.service needs Resource Sure!
  • You now have access to Bob’ s photos Printer.service needs Resource Photo.service has Resource
  • Send me the holiday photos! Printer.service needs Resource Photo.service has Resource
  • Here you go! Printer.service needs Resource Photo.service has Resource
  • I printed the photos. Printer.service needs Resource Photo.service has Resource
  • Photo.service has Resource Printer.service needs Resource Note: Printer.service does not hold Bob’s key to Photo.service
  • The PHOTO app chooses and control what OAuth provider to integrate, so the user cannot choose the identity he wants
  • Based on API authorizations and endpoints between applications
  • -
  • Single Sign-On conclusion - OpenID (URLs) is a group of companies that trust each other to be an identity provider (IDP) OpenID let the choice to the user of the IDP - Facebook connect (Facebook Connect was the single sign on of Facebook affiliate ecosystem) - OAuth : the OAuth provider know the user AND the application. The End user application choose the IDP the end user can connect with.
  • OpenID OAuth SAML Dates from 2005 2006 2001 Current version OpenID 2.0 OAuth 2.0 SAML 2.0 API Single sign-on Single sign-on authorization for enterprise Main purpose for consumers between users applications Protocols used XRDS, HTTP JSON, HTTP SAM, XML, HTTP, SOAP
  • OAuth and the Highway to Hell OAuth 2.0 and the Road to Hell (Eran Hammer)
  • OAuth 1.0 (2007) OAuth provides a method for clients to access server resources on behalf of a resource owner (such as a different client or an end- user). It also provides a process for end-users to authorize third-party access to their server resources without sharing their credentials (typically, a username and password pair), using useragent redirections. http://tools.ietf.org/html/rfc5849
  • Context : - php 4 - no https - Google involved - not Open ID OAuth 1.0 (2007) Pain: - Signatures - Broken libraries - Extensions - Crappy specifications From Eran Hammer #FuckOauth OAuth 2.0 - Looking Back and Moving On
  • OAuth 1.0a (one legged) OAuthBible #
  • OAuth 1.0a (two legged) OAuthBible #
  • OAuth 1.0a (three legged) OAuthBible #
  • OAuth 1.0a (Echo) OAuthBible #
  • OAuth 1.0a (xAuth) OAuthBible #
  • OAuth 2.0
  • Authentication and Signatures - Stop cryptographic requirements of signing requests with the client ID and secret and replaces signatures with requiring HTTPS for all communications between browsers, clients and the API.
  • User Experience and Alternative Authorization Flows OAuth 2 supports a better user experience for native applications, and supports extending the protocol to provide compatibility with future device requirements.
  • Performance at Scale - Many steps require state management and temporary credentials, which require shared storage and are difficult to synchronize across data centers. - requires that the API server has access to the application's ID and secret, which often breaks the architecture of most large providers where the authorization server and API servers are completely separate.
  • - OAuth 2.0 (Two-legged) Client credential Resource user password - OAuth 2.0 (Three-legged) - OAuth 2.0 (Refresh token) Scopes are often not implemented the good way, following the specs. Sometimes spaces are not set, names are different from providers…. #OAuthBible
  • OAuth is fragmented. OAuth is broken.
  • OAuth 2.0 is a compromise.
  • -
  • Eran Hammer has quit the OAuth 2.0 Board. He is building Oz.
  • Solutions to Consume OAuth ? - The IETF specs - The OAuth Bible - Open source libraries (omniauth for ruby, requests or foauth for python, passport for node.js…) - Janrain, Dailycred - OAuth.io
  • OAuth.io
  • Demo
  • OAuth.io
  • OAuth.io
  • Demo
  • oauthd Open source version of OAuth.io
  • The Glue of OAuth? https://github.com/oauth-io/oauthd/blob/master/providers
  • OAuth Report #SOCIAL LOGIN
  • The future? Mozilla Persona (Browser ID) Docker.io
  • Thank you! Mehdi Medjaoui @medjawi webshell.io oauth.io