The document discusses how to integrate OAuth into mobile apps for security purposes. It provides an overview of OAuth basics, including the actors (client, authorization server, resource server, resource owner), common flows, and use of JSON Web Tokens. It also discusses related standards like SCIM, SAML, and OpenID Connect, with OAuth serving as the meta-protocol for handling tokens across these different approaches. The goal is to explain how OAuth addresses old security requirements and solves new problems in a standardized way for modern app development.

1. Incorporating OAuth
How to integrate OAuth into your mobile app
By Travis Spencer, CEO
@travisspencer, @2botech
Copyright © 2013 Twobo Technologies AB. All rights reserved

2. Agenda
 The security challenge in context
 Neo-security stack
 OAuth Basics
 Overview of other layers
Copyright © 2013 Twobo Technologies AB. All rights reserved

3. Crucial Security Concerns
Copyright © 2013 Twobo Technologies AB. All rights reserved
Enterprise
Security
API
Security
Mobile
Security

4. Identity is Central
Copyright © 2013 Twobo Technologies AB. All rights reserved
MDM MAM
A
u
t
h
Z
Mobile
Security
API
Security
Enterprise
Security
Identity
Venn diagram by Gunnar Peterson

5. Neo-security Stack
 SCIM, SAML, OAuth, and JWT are the new
standards-based cloud security stack
 OAuth 2 is the new meta-protocol defining how
tokens are handled
 These address old requirements, solves new
problems & are composed
in useful ways
Copyright © 2013 Twobo Technologies AB. All rights reserved
Grandpa SAML
& junior
OpenID Connect

6. OAuth Actors
 Client
 Authorization Server (AS)
 Resource Server (RS) (i.e., API)
 Resource Owner (RO)
Copyright © 2013 Twobo Technologies AB. All rights reserved
Getatoken
User a token
RS Client
AS

7. OAuth Mobile App Flow
Copyright © 2013 Twobo Technologies AB. All rights reserved

8. Request Authorization
Copyright © 2013 Twobo Technologies AB. All rights reserved

9. Authenticate & Authorize
Copyright © 2013 Twobo Technologies AB. All rights reserved

10. Register Custom Scheme in App
<activity android:name=".CallbackActivity“ …>
<intent-filter>
<data android:scheme="twobo" />
…
</intent-filter>
</activity>
Copyright © 2013 Twobo Technologies AB. All rights reserved

11. Callback to Custom Scheme
In OAuth Server, configure to callback to scheme
that was registered
Copyright © 2013 Twobo Technologies AB. All rights reserved

12. Exchange Code for Token
Copyright © 2013 Twobo Technologies AB. All rights reserved
AC

13. Calling the Token Endpoint
var data = {
"client_id" : clientId,
"client_secret" : clientSecret,
"code" : code,
"grant_type" : "authorization_code",
"response_type" : "token" };
$.post(tokenEndpoint, data,
processAccessToken, "json");
Copyright © 2013 Twobo Technologies AB. All rights reserved
AC AT, RT

14. Tokens are Often JWTs
 Pronounced like the English word “jot”
 Lightweight tokens passed in HTTP headers &
query strings
 Akin to SAML tokens
 Less expressive
 Less security options
 More compact
 Encoded w/ JSON not XML
Copyright © 2013 Twobo Technologies AB. All rights reserved

15. Calling the API
Provide AT to API according to bearer token profile
$.ajax({
url: apiEndpoint,
dataType: 'json',
headers: {"Authorization":"Bearer "+accessToken},
success: processResults });
Copyright © 2013 Twobo Technologies AB. All rights reserved

16. API May Validate Token
def validateToken(self, tokenEndpoint, clientId,
clientSecret, accessToken):
values = { "client_id" : clientId,
"client_secret" : clientSecret,
"grant_type" : “…",
"token" : accessToken, }
request = urllib2.Request(tokenEndpoint,
urllib.urlencode(values))
return urllib2.urlopen(request)Copyright © 2013 Twobo Technologies AB. All rights reserved

17. • App should only present
AT to API
• Never send RT to API
• Use RT to get new AT if
AT expires
• App can’t use AT to
determine anything about
user
App Consumes API Data
Copyright © 2013 Twobo Technologies AB. All rights reserved

18. Overview of OpenID Connect
 Builds on OAuth for profile sharing
 Uses the flows optimized for user-consent
scenarios
 Adds identity-based inputs/outputs to core OAuth
messages
 Tokens are JWTs
Copyright © 2013 Twobo Technologies AB. All rights reserved

19. What OAuth is and is not for
Copyright © 2013 Twobo Technologies AB. All rights reserved
Not for authentication
Not really for authorization
For delegation

20. Questions & Thanks
@2botech
@travisspencer
www.2botech.com
travisspencer.com
Copyright © 2013 Twobo Technologies AB. All rights reserved