Download as PDF, PPTX
![Webfinger response
HTTP/1.1 200 OK!
Access-Control-Allow-Origin: *!
Content-Type: application/jrd+json!
!
{!
"subject" : "acct:carol@example.com",!
"links" :!
[ {!
"rel" : "http://openid.net/specs/connect/1.0/issuer",!
"href" : "https://openid.example.com"!
} ]!
}](https://image.slidesharecdn.com/cisopenidconnectintro-140811131050-phpapp02/85/CIS14-Working-with-OAuth-and-OpenID-Connect-27-320.jpg)
Uploaded byCloudIDSummit
CIS14: Working with OAuth and OpenID Connect
The document provides an overview of OAuth 2.0 and OpenID Connect, detailing how OAuth 2.0 enables limited access to HTTP services through various authorization flows. It describes the differences between OAuth and OpenID Connect, highlighting the additional identity layer and the processes for provider discovery and client registration. Key components such as authorization requests, access tokens, and ID tokens are also elaborated, emphasizing the importance of authentication and information claims.
More Related Content
![[LDAPCon 2015] The OpenID Connect Protocol](https://cdn.slidesharecdn.com/ss_thumbnails/ldapcon2015openidconnect-151117105614-lva1-app6892-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to CIS14: Working with OAuth and OpenID Connect
![OpenID Connect - a simple[sic] single sign-on & identity layer on top of OAut...](https://cdn.slidesharecdn.com/ss_thumbnails/gluecon2014-oidc-140521065808-phpapp01-thumbnail.jpg?width=640&height=640&fit=bounds)
CIS14: Working with OAuth and OpenID Connect
- 1. OAuth 2.0 andOpenID Connect Basics From OAuth2 to OpenID Connect by Roland Hedberg
- 2. Let’s start withOAuth2
- 3. ❖ The OAuth2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, ! ❖ either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, ! ❖ or by allowing the third-party application to obtain access on its own behalf.
- 4. The players Authorization Server ResourceServerClient
- 5. Authorization Request Authorization Server ResourceServer Client Authorization request
- 6. Authorization Request -details Parameters! client_id! redirect_uri! response_type! scope! state Authorization Server Resource Server Client Authorization request GET! http://example.com/authorization?state=1521671980316802035&! ! redirect_uri=https://example.org/authz_cb&! ! response_type=code&! ! client_id=SFEBuhC7sp3a
- 7. Authorization Server Resource Server Client AUTHENTICATIONHAPPENS & End-user consent/authorization
- 8. Authorization Response Authorization Server ResourceServer Client Authorization response
- 9. Authorization Response -details Authorization Server Resource Server Client Authorization response GET! https://example.org/authz_cb?state=1521671980316802035&! ! code=s87BT60pp2UbNX2HnkWpZ9YhPVHRZaoTuU9XJul6JMuQaKUidUM6y1Boab6 Parameters code! state access_token! token_type! expires_in! scope! state
- 10. Access Token Request AuthorizationServer Resource Server Client Access token request
- 11. Access Token Request- details POST! http://example.com/token! ! code=s87BT60pp2UbNX2HnkWpZ9YhPVHRZaoTuU9XJul6JMuQaKUidUM6y1Boab6&! ! grant_type=authorization_code&! ! redirect_uri=https://example.org/authz_cb Authorization Server Resource Server Client Access token request Parameters! client_id! code! grant_type! redirect_uri
- 12. Access Token Response AuthorizationServer Resource Server Client Access token response
- 13. Access Token Response- details {! ! 'access_token': ’s87BT60pp2UbNX2HnkWpfPfWNo9Gi7chACuWoa2IDND', ! ! 'expires_in': 3600, ! ! 'refresh_token': ’s87BT60pp2U+bNX2HnkWpVCnDYPsy8EOpI’! ! 'state': ’STATE0’,! ! 'token_type': 'Bearer', ! } Authorization Server Resource Server Client Access token response Parameters! access_token! expires_in! refresh_token scope! token_type
- 14. Resource Access Authorization Server ResourceServer Client Resource request/response
- 15. Resource Access -details Authorization Server Resource Server Client Resource request/response GET! https://example.com/resource! ! Header:! ! Authorization: ’Bearer s87BT60pp2UbNX2HnkWpfPfWNo9Gi7chACuWoa2IDND’!
- 16. The whole Authorization Server ResourceServer Client Authorization request Authorization Server Resource Server Client Authorization response Authorization Server Resource Server Client Access token request Authorization Server Resource Server Client Access token response Authorization Server Resource Server Client Resource request/response Authorization Server Resource Server Client AUTHENTICATION HAPPENS & End-user consent/authorization
- 17. Flows ❖ Authorization CodeGrant! ❖ Implicit Grant! ❖ Resource Owner Password Credentials Grant! ❖ Client Credentials Grant
- 18. Implicit grant Authorization Server ResourceServer Client Authorization request Authorization Server Resource Server Client Resource request/response Authorization Server Resource Server Client Authorization response Authorization Server Resource Server Client AUTHENTICATION HAPPENS & End-user consent/authorization
- 19. Resource Owner PasswordCredentials Grant & Client Credentials Grant Authorization Server Resource Server Client Access token request Authorization Server Resource Server Client Access token response Authorization Server Resource Server Client Resource request/response
- 20. From OAuth2 toOpenID Connect
- 21. ❖ OpenID Connect1.0 is a simple identity layer on top of the OAuth 2.0 protocol. ! ❖ It enables Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server, as well as to obtain basic profile information about the End-User in an interoperable and REST-like manner.
- 22. The differences ❖ Onlyauthorization grant and implicit grant flows! ❖ Dynamic provider discovery and client registration! ❖ ID Token! ❖ Additions/Clarifications/Constrictions! ❖ UserInfo endpoint
- 23. Flows ❖ Authorization code! ❖Implicit! ❖ Hybrid (authorization code with a twist)! ❖ code id_token! ❖ code token! ❖ code id_token token
- 24. Dynamic provider discovery andclient registration
- 25. Dynamic discovery andregistration 1. Find the provider! 2. Discover provider info! 3. Register client
- 26. 1.Find the provider ❖Webfinger (RFC 7033)! ❖ User identifier -> URL! ❖ carol@example.org ->! ! GET /.well-known/webfinger?! resource=acct:carol@example.com&! rel=http://openid.net/specs/connect/1.0/issuer! HTTP/1.1! Host: example.com
- 27. Webfinger response HTTP/1.1 200OK! Access-Control-Allow-Origin: *! Content-Type: application/jrd+json! ! {! "subject" : "acct:carol@example.com",! "links" :! [ {! "rel" : "http://openid.net/specs/connect/1.0/issuer",! "href" : "https://openid.example.com"! } ]! }
- 28. 2.Discover provider info- query GET /.well-known/openid-configuration HTTP/1.1! Host: openid.example.com
- 29. 2. Discover providerinfo - response ❖ issuer! ❖ jwks_uri! ❖ endpoints! ❖ functions supported! ❖ support for signing/encrypting algorithms! ❖ policy/tos
- 30. Required information ❖ issuer! ❖jwks_uri! ❖ authorization_endpoint! ❖ token_endpoint (*)! ❖ response_types_supported! ❖ subject_types_supported! ❖ id_token_signing_alg_supported
- 31. 3. Client registration ❖uris! ❖ application information! ❖ support for signing/encrypting algorithms! ❖ key material! ❖ server behavior! ❖ client behavior
- 32.
- 33. Client registration response ❖client_id! ❖ possibly client_secret and if so client_secret_experies_at! ❖ and the Authorization servers view of things
- 34. An Authorization Server ❖MAY add fields the client didn’t include.! ❖ MAY reject or replace any of the Client's requested field values and substitute them with suitable values.! ❖ MAY ignore values provided by the client, and MUST ignore any fields sent by the Client that it does not understand.
- 35. A Client cannot ❖ modify a registration! ❖ delete a registration
- 36.
- 37. ID Token ❖ Haveto make a detour into JWT/K/A/S/E land
- 38. JWT ❖ Jason WebToken! ❖ a compact URL-safe means of representing claims to be transferred between two parties! ❖ Suggested pronunciation: ’jot’
- 39. JWS represents content securedwith digital signatures or Message Authentication Codes (MACs) using JavaScript Object Notation (JSON) based data structures. JWE represents encrypted content using JavaScript Object Notation (JSON) based data structures.
- 40. JWK a JavaScript ObjectNotation (JSON) data structure that represents a cryptographic key JWA registers cryptographic algorithms and identifiers to be used with the JSON Web Signature(JWS), JSON Web Encryption (JWE), and JSON Web Key (JWK) specifications
- 41. ID Token ❖a securitytoken that contains Claims about the Authentication of an End-User by an Authorization Server when using a Client, and potentially other requested Claims. ! ❖is represented as a JSON Web Token (JWT)
- 42. ID Token claims-required ❖ iss - Issuer Identifier for the Issuer of the response! ❖ sub - Subject Identifier! ❖ aud - Intended audience! ❖ exp - Expiration time! ❖ iat - Issued at! ❖ auth_time - Authentication time! ❖ nonce
- 43. ID Token claims- optional ❖ acr - Authentication Context Class Reference! ❖ amr - Authentication Method References! ❖ azp - Authorized party
- 44.
- 45. OAuth2 Authorization Request- details Parameters! client_id! redirect_uri! response_type! scope! state Authorization Server Resource Server Client Authorization request GET! http://example.com/authorization?state=1521671980316802035&! ! redirect_uri=https://example.org/authz_cb&! ! response_type=code&! ! client_id=SFEBuhC7sp3a
- 46. Authentication Request -OpenID Connect extensions ❖ response_mode - The mechanism to use for returning parameters! ❖ nonce - Associates client session with ID Token! ❖ Signed/encrypted Authentication Request! ❖ End-user interactions! ❖ Response details
- 47. Signed/encrypted Authentication Request ❖request - by value! ❖ request_uri - by reference! ! ❖ Single self-contained parameter! ❖ Signed and/or encrypted (JWT)
- 48. End-user interactions ❖ display- How to display pages to End-User! ❖ prompt - If the End-User should be prompted for re-authentication/ consent! ❖ max_age - allowed max time since last authentication! ❖ ui_locales - End-User’s preferred languages and scripts! ❖ id_token_hint - ID Token previously issued ! ❖ login_hint - login identifier the End-User might want to use! ❖ acr_values - requested Authentication Context Class Reference values
- 49. Response details ❖ claims! ❖user_info! ❖ id_token! ! ❖ claims specification! ❖ null! ❖ essential! ❖ value! ❖ values
- 50.
- 51. User info ❖ sub! ❖name! ❖ given_name! ❖ family_name! ❖ middle_name! ❖ nickname! ❖ preferred_username Set of standard claims ❖ profile! ❖ picture! ❖ website! ❖ email! ❖ email_verified! ❖ gender! ❖ birthdate ❖ zoneinfo! ❖ locale! ❖ phone_number! ❖ phone_number_verfied! ❖ address! ❖ updated_at!
- 52. claims types ❖ Normal! ❖Aggregated! ❖ Distributed
- 53. Summary ❖ OAuth2 isabout authorization! ❖ OpenID Connect adds authentication and identity information
- 54.