This document provides an overview of OpenID Connect, which is a standard protocol for user authentication and authorization. It describes how OpenID Connect provides a secure login mechanism for applications by defining standard APIs for authentication, authorization, single sign-on, and single logout. The document explains the OpenID Connect flow, advantages of using the standard, and security aspects like signed JSON Web Tokens and preventing request tampering. It also discusses solutions built on OpenID Connect and tips for application developers in implementing authentication securely.

1. OpenID Connect:
Building a secure login for your apps the right way!
Farasath Ahamed
IAM Team,
WSO2

2. Building an App
2

3. Building an application
3
● Building user signup
● Building a login/logout mechanism
(authentication and authorization)
● Building reset password / recovery
● Managing users/profiles/sessions.
● The actual app functionality.

4. What do we usually do
wrong?
4

5. What do we do wrong?
5
● Either consider security as an afterthought or end
up over-engineering security.
● Baking in authentication and authorization logic
into the app.
● Thinking that people will use the app as we
want.

6. Common mistakes
and
misconceptions...
6

7. Common mistakes and misconceptions
7
● Trying to implement personally developed
security measures
○ Security loopholes
● Reinventing the wheel.
○ User stores
○ Social Login options
○ Libraries

8. Common mistakes and misconceptions
8
● Not thinking about the user experience
○ Specially user signup
○ MFA
○ Not thinking about single sign on
So what can we do better?

9. Warm Up
9

10. Authentication
10

11. Authorization
11

12. Single Sign On
12

13. Single Logout
13

14. Few more terms...
14
● Identity Provider
● Service Provider

15. OpenID Connect?
15

16. OpenID Connect
16
● Provides a standard API for login
○ Request <-> Response
○ A verifiable token containing user identity
(ID Token)
○ An access token that can be used to
obtain further user information
○ Access token also allows scoped
authorization

17. OpenID Connect
17
● Defines a standard mechanism for single logout
● Provides a standard API for client registration
● Provides a standard API for information
discovery
● Build with security in mind.
● Provides an authentication + authorization layer.

18. The Flow
18

19. The OpenID Connect Login
19
Application is registered at the OP (OpenID provider)
1. Send an OpenID Connect Request to OP
2. User is authenticated at the OP
3. User is requested for consent at the OP
4. Application receives an intermediate ‘code’.
5. Application sends the code with the application authentication
information.
6. The application receives an id_token + access token in the
response. App verifies the id_token and completes the login

20. The OpenID Connect Login
20

21. Let’s see it action
21

22. OpenID Connect Login : Request
22
https://accounts.google.com/o/oauth2/v2/auth?redirect_uri=https://
developers.google.com/oauthplayground&prompt=consent&respons
e_type=code&client_id=407408718192.apps.googleusercontent.co
m&scope=openid email profile
https://www.googleapis.com/auth/xapi.zoo&access_type=offline

23. OpenID Connect Login : Authentication at OP
23

24. OpenID Connect Login : Consent at OP
24

25. OpenID Connect Login : Response
25
https://developers.google.com/oauthplayground/?code=4/6Q
BptdphHUBvd7X_lpOS5N2BlPvBy1QhrTfnNGlXKr-
pu3k6znBQF_s6YGjbSGibtwlUi5Q90rfqVrUgxfbqIKA&scope=o
penid%20email%20profile%20https://www.googleapis.com/au
th/userinfo.email%20https://www.googleapis.com/auth/userinfo
.profile%20https://www.googleapis.com/auth/xapi.zoo&authuse
r=0&session_state=7414bbf805e2f09026ee7065bc7358b466
60897a..d46e&prompt=consent

26. OpenID Connect Login : Token Request
26
POST /oauth2/v4/token HTTP/1.1
Host: www.googleapis.com
Content-length: 277
content-type: application/x-www-form-urlencoded
user-agent: google-oauth-playground
code=4%2F6QAsx1elz4EirZXkhCRW3jrM6-
A5ABq_2IrbdHDhPrfm3b6Fwhrld1gLswcBSNxNE3z-
E0sg4EJA79Pxm56gIwM&redirect_uri=https%3A%2F%2Fdevelopers
.google.com%2Foauthplayground&client_id=407408718192.apps.goo
gleusercontent.com&client_secret=************&scope=&grant_type=
authorization_code

27. OpenID Connect Login : Response
27
{
"access_token": "ya29.GluoBu2HS6hrn7vVeTexqrW3m3i3sGLc6-
kEaH_WK5aJmVtMyGMJY1kmlItrvj3S4WXd-
arf199factfJVnq2Dr3GCNQsaVgCzPibWRGAZCTu18J67dAlwkuSY7a",
"id_token": "eyJhbGciOiJSUzI1…….",
"expires_in": 3600,
"token_type": "Bearer",
"scope": "https://www.googleapis.com/auth/plus.me
https://www.googleapis.com/auth/userinfo.email",
"refresh_token": "1/MOMjcw6wBrJBtHY5TzIw4wGg5SRt1fJhkOlp-hZo7LQ"
}

28. Code Flow
28

29. OpenID Connect Login : Code Flow
29

30. Implicit Flow
30

31. OpenID Connect Login : Implicit Flow
31

32. OpenID Connect Login : Code vs Implicit
32

33. Demo Time!
33

34. Why should we use
OpenID Connect?
34

35. OpenID Connect : Why?
35
● Let’s app and site developers authenticate users
without taking on the responsibility of storing
and managing passwords (Federation)
● End users have control over their data shared
with the app.

36. OpenID Connect : Why?
36
● It’s a well recognized industry standard / API
○ Wide range of OPs to choose from
○ Libraries
○ JSON over HTTP
○ Well tested in terms of security
○ Zero code change solutions available

37. OpenID Connect : Why?
37
● Enables BYOID (Bring your own identity)
● Enables an easy path provide Single Sign On
○ Most IDPs support OpenID Connect
○ Most SaaS apps support OpenID connect

38. Security in OpenID Connect
38

39. OpenID Connect : Security Aspects
39
● Use of signed JWTs to pass user authentication
information
○ App must verify id_token sent in response
● Request objects to prevent request tampering
○ Sending request params in a signed JWT.
● ‘state’ parameter to avoid CSRF token
● ‘nonce’ parameter to avoid replay attacks

40. OIDC Logout
40

41. OIDC Session Management
41

42. OpenID Connect Logout
42

43. Back Channel
43

44. OpenID Connect Backchannel Logout
44

45. Demo Time!
45

46. Solutions built on top of
OpenID Connect
46

47. Mobile Connect
47

48. OpenID Connect in Open Banking
48
● Open Banking Standards are built with data
security and customer consent at their heart.
● Uses OpenID Connect as the authentication and
authorization layer
● Uses OpenID Connect Hybrid Flows to enforce
security

49. Tips for Application Devs
49

50. Few Tips from one Dev to another
50
● Try to use a standard APIs/solutions for
authentication and authorization.
● Opensource != unsecure
● Use standard libraries.
● Think about how easy it is to migrate from one
vendor to another.
● Think about the user experience (Enabling
BYOID is now becoming a MUST)

51. Credits
51
● All the diagrams I have used in this slide deck
were generously borrowed from various blogs,
websites etc. So the due credit should go to the
respective authors :)