Download as PDF, PPTX
Uploaded byMehdi Medjaoui
OAuth with OAuth.io : solving the OAuth Fragmentation for Identity Management on the Web
The document discusses the challenges of authentication and identity management through passwords and the emergence of single sign-on (SSO) solutions to enhance user experience and security. It explores the evolution of OAuth protocols, highlighting the differences between OAuth 1.0 and 2.0, and the importance of identity providers in granting access to user resources without sharing credentials. The author emphasizes the need for better user experience and security in authorization processes, while noting the fragmentation and limitations within current OAuth implementations.
OAuth with OAuth.io : solving the OAuth Fragmentation for Identity Management on the Web
- 1.
- 2.
- 3.
- 5.
- 6. I want toupload my photos to access them from anywhere
- 7.
- 8.
- 9.
- 10.
- 11.
- 12.
- 13.
- 14.
- 15.
- 16.
- 17.
- 18.
- 19.
- 20. Authentication = Identification+ Verification
- 21. To correctly verifysomeone, a secret must relate to: - what they know - what they have - what they are - what they can do
- 22.
- 23.
- 28.
- 29.
- 30.
- 31.
- 32.
- 33.
- 34. Got cloudy thesedays...
- 36. Multiplication of webservices have made passwords - hard to remember if unique
- 38. Multiplication of webservices have made passwords - hard to remember if unique - annoying to type all day if strong
- 40.
- 41. Multiplication of webservices have made passwords - hard to remember if unique - annoying to type all day if strong - weak if not unique
- 42. Passwords (even strong) donot scale with a growing number of services
- 43. Solution = Passwordmanager ?
- 44.
- 45.
- 46. Single Sign-On Single sign-on(SSO) is a property of access control of multiple related, but independent software systems.
- 47. The promise ofSSO: - UX with frictionless sign in and higher conversion - Reduced IT costs - Retrieving data with user’s consent but without annoying forms - Reduced password leak risks
- 48. - SAML - OpenID -Facebook connect - OAuth - Persona
- 50.
- 51.
- 52.
- 53.
- 54.
- 55.
- 56.
- 57.
- 58. - Based on URLsfor personal data http://google.com/profiles/me username.wordpress.com blogname.blogspot.com www.myspace.com/username
- 59.
- 60. I want toprint my photos from photo. service with printer. service
- 61.
- 62. Photo.service has Resource Printer.service needs Resource Keyto photo. service
- 63. Photo.service has Resource Printer.service needs Resource Hi,I want to print my photos.
- 64.
- 65.
- 66. Hi I’m Bob& I have the key Printer.service needs Resource Photo.service has Resource
- 67.
- 68. Please send me these photos Printer.service needsResource Photo.service has Resource
- 69. Here you go Printer.service needsResource Photo.service has Resource
- 70. I printed the photos. Printer.service needsResource Photo.service has Resource
- 71. I’m gonna look atall of Bob’s photos! Rogue Printer. service needs Resource Photo.service has Resource
- 72. without his consent... Rogue Printer. service needsResource Photo.service has Resource
- 73. Never give your passwordto other services
- 74.
- 75.
- 76.
- 78. Photo.service has Resource Printer.service needs Resource Keyto photo. service
- 79.
- 80. I have support forPhoto. service, ... Printer.service needs Resource Photo.service has Resource
- 81. I have support forPhoto. service, ... Printer.service needs Resource Photo.service has Resource Note: choice of supported resource providers has also to be made by printer. service
- 82. Photo.service has Resource Printer.service needs Resource Pleaseuse Photo.service
- 83. Hi, I’m Printer. service Printer.service needsResource Photo.service has Resource
- 84.
- 85.
- 86.
- 87. I need accessto Bob’s photos Printer.service needs Resource Photo.service has Resource
- 88.
- 89. Photo.service has Resource Printer.service needs Resource I’mBob. Here’ s my key
- 90. Photo.service has Resource Printer.service needs Resource Doyou allow Pr.S. to access your photos?
- 91.
- 92. You now have accessto Bob’ s photos Printer.service needs Resource Photo.service has Resource
- 93. Send me the holidayphotos! Printer.service needs Resource Photo.service has Resource
- 94. Here you go! Printer.service needsResource Photo.service has Resource
- 95. I printed the photos. Printer.service needsResource Photo.service has Resource
- 96. Photo.service has Resource Printer.service needs Resource Note:Printer.service does not hold Bob’s key to Photo.service
- 97. The PHOTO appchooses and control what OAuth provider to integrate, so the user cannot choose the identity he wants
- 99. Based on APIauthorizations and endpoints between applications
- 100.
- 101. Single Sign-On conclusion - OpenID(URLs) is a group of companies that trust each other to be an identity provider (IDP) OpenID let the choice to the user of the IDP - Facebook connect (Facebook Connect was the single sign on of Facebook affiliate ecosystem) - OAuth : the OAuth provider know the user AND the application. The End user application choose the IDP the end user can connect with.
- 102. OpenID OAuth SAML Dates from 2005 2006 2001 Current version OpenID2.0 OAuth 2.0 SAML 2.0 API Single sign-on Single sign-on authorization for enterprise Main purpose for consumers between users applications Protocols used XRDS, HTTP JSON, HTTP SAM, XML, HTTP, SOAP
- 103. OAuth and the Highwayto Hell OAuth 2.0 and the Road to Hell (Eran Hammer)
- 105. OAuth 1.0 (2007) OAuth providesa method for clients to access server resources on behalf of a resource owner (such as a different client or an end- user). It also provides a process for end-users to authorize third-party access to their server resources without sharing their credentials (typically, a username and password pair), using useragent redirections. http://tools.ietf.org/html/rfc5849
- 106. Context : - php4 - no https - Google involved - not Open ID OAuth 1.0 (2007) Pain: - Signatures - Broken libraries - Extensions - Crappy specifications From Eran Hammer #FuckOauth OAuth 2.0 - Looking Back and Moving On
- 107.
- 108.
- 109.
- 110.
- 111.
- 112.
- 113. Authentication and Signatures -Stop cryptographic requirements of signing requests with the client ID and secret and replaces signatures with requiring HTTPS for all communications between browsers, clients and the API.
- 114. User Experience andAlternative Authorization Flows OAuth 2 supports a better user experience for native applications, and supports extending the protocol to provide compatibility with future device requirements.
- 115. Performance at Scale -Many steps require state management and temporary credentials, which require shared storage and are difficult to synchronize across data centers. - requires that the API server has access to the application's ID and secret, which often breaks the architecture of most large providers where the authorization server and API servers are completely separate.
- 116. - OAuth 2.0(Two-legged) Client credential Resource user password - OAuth 2.0 (Three-legged) - OAuth 2.0 (Refresh token) Scopes are often not implemented the good way, following the specs. Sometimes spaces are not set, names are different from providers…. #OAuthBible
- 117. OAuth is fragmented. OAuthis broken.
- 118. OAuth 2.0 isa compromise.
- 119.
- 120. Eran Hammer hasquit the OAuth 2.0 Board. He is building Oz.
- 121. Solutions to ConsumeOAuth ? - The IETF specs - The OAuth Bible - Open source libraries (omniauth for ruby, requests or foauth for python, passport for node.js…) - Janrain, Dailycred - OAuth.io
- 123.
- 124.
- 125.
- 126.
- 127.
- 128. oauthd Open source versionof OAuth.io
- 129. The Glue ofOAuth? https://github.com/oauth-io/oauthd/blob/master/providers
- 130.
- 135. The future? Mozilla Persona(Browser ID) Docker.io
- 137.