The document provides an overview of OpenID Connect, a new standard for identity that is based on OAuth 2.0. It discusses how OpenID Connect allows clients to authenticate users through an authorization server without having to handle usernames and passwords. The document outlines the basic OpenID Connect workflow which involves the client obtaining an ID token from the authorization server after the user authenticates. This ID token contains claims about the user that are verified by the authorization server's signature. The document encourages developers to leverage OpenID Connect to build applications that can acquire customers through social sign-on and to rapidly develop secure mobile apps.

1. OpenID Connect
The new standard for connecting to your Customers, Partners, Apps, and Devices
April 9, 2014

2. #forcewebinar
Safe Harbor
Safe harbor statement under the Private Securities Litigation Reform Act of 1995:
This presentation may contain forward-looking statements that involve risks, uncertainties, and assumptions. If any such uncertainties materialize or if any of
the assumptions proves incorrect, the results of salesforce.com, inc. could differ materially from the results expressed or implied by the forward-looking
statements we make. All statements other than statements of historical fact could be deemed forward-looking, including any projections of product or service
availability, subscriber growth, earnings, revenues, or other financial items and any statements regarding strategies or plans of management for future
operations, statements of belief, any statements concerning new, planned, or upgraded services or technology developments and customer contracts or use
of our services.
The risks and uncertainties referred to above include – but are not limited to – risks associated with developing and delivering new functionality for our
service, new products and services, our new business model, our past operating losses, possible fluctuations in our operating results and rate of growth,
interruptions or delays in our Web hosting, breach of our security measures, the outcome of intellectual property and other litigation, risks associated with
possible mergers and acquisitions, the immature market in which we operate, our relatively limited operating history, our ability to expand, retain, and
motivate our employees and manage our growth, new releases of our service and successful customer deployment, our limited history reselling non-
salesforce.com products, and utilization and selling to larger enterprise customers. Further information on potential factors that could affect the financial
results of salesforce.com, inc. is included in our annual report on Form 10-Q for the most recent fiscal quarter ended July 31, 2012. This documents and
others containing important disclosures are available on the SEC Filings section of the Investor Information section of our Web site.
Any unreleased services or features referenced in this or other presentations, press releases or public statements are not currently available and may not be
delivered on time or at all. Customers who purchase our services should make the purchase decisions based upon features that are currently available.
Salesforce.com, inc. assumes no obligation and does not intend to update these forward-looking statements.

3. #forcewebinar
Speakers
Pat Patterson
Developer Evangelist Architect
@metadaddy
Chuck Mortimore
Vice President, Identity
@cmort
Ian Glazer
Senior Director, Identity
@iglazer

4. #forcewebinar
Follow Developer Force for the Latest News
@forcedotcom / #forcewebinar
Developer Force – Force.com Community
+Developer Force – Force.com Community
Developer Force
Developer Force Group

5. #forcewebinar
Agenda
§ Introduction
§ Overview
§ Demo
§ Protocol
§ Roadmap

6. #forcewebinar
Have Questions?
§ We have an expert support team at the ready to answer your questions
during the webinar.
§ Ask your questions via the GoToWebinar Questions Pane.
§ The speaker(s) will chose top questions to answer live at the end of the
webinar.
§ Please post your questions as we go along!
§ Only post your question once; we’ll get to it as we go down the list.

7. Introduction:
Ian Glazer

9. OpenID Connect:
What is it?

10. #forcewebinar
Chapter 1:
OpenID Connect
§ Authenticate users without having to get your hands dirty
with passwords
§ Learn about the person using your service using modern
identity tools
§ Informed by a long history of identity standards
§ Based on OAuth2

11. #forcewebinar
Why should I care about OpenID Connect?
Identity Professionals Developers Business
§ Focus on business
enablement
§ OIDC is SAML for our
RESTful web-oriented
architecture world
§ Support use cases the
business cares about
including mobile and
social
§ Focus on the
awesome – the user
journey
§ Don’t have to deal with
username, passwords,
PKI, and LDAP
§ Strong credentials
without all the mess
§ Engage with internal and
external customers
§ Make it easier for
customers to interact with
you
§ Avoids having to issue your
customers yet another set
of credentials

12. #forcewebinar
Where identity and access management got started
Identity

13. #forcewebinar
Identity
And then cloud and mobile happened

14. #forcewebinar
Identity
Customers
Partners
Products
Where we must go

15. #forcewebinar
Use-Cases
Mobile Apps & Connected ProductsSocial Sign-On

16. OpenID Connect Stack

17. OpenID Connect Stack

18. Too much? Start with the Basic Client
Just read this:
http://openid.net/specs/openid-connect-basic-1_0.html

19. Or better yet… just use the Salesforce1 platform
OpenID Connect Relying Party
Authentication Provider
(the Client Side)
OpenID Connect Provider
Connected Apps
(the Server Side)

20. OpenID Connect:
How Does it Work?

21. #forcewebinar
OpenID Connect – Basic Client Profile
End-UserClient Auth Server
Authorization Request
https://login.salesforce.com/services/oauth2/authorize?!
response_type=code&!
client_id=3MVG9lKcPoNINVBLWJnB_Y...Lsn&!
redirect_uri=https%3A%2F%2Fwww.example.com%2Foauth
%2Fcallback&!
state=BLAH_BLAH_BLAH!
Redirect with Authz Request

22. #forcewebinar
OpenID Connect – Basic Client Profile
End-UserClient Auth Server
Authenticate End-User
Credentials/Constent
Redirect to Client
Authorization Response
Redirect with Authz Request
Authorization Request
https://www.example.com/oauth/callback/?!
state=BLAH_BLAH_BLAH&!
code=aPrxsmIEeqM9PiSOCErbySxQvb...5sdWyjE.DG_TNeow==!

23. #forcewebinar
OpenID Connect – Basic Client Profile
End-UserClient Auth Server
Authenticate End-User
Credentials/Constent
Redirect to Client
Authorization Response
Token Request
Redirect with Authz Request
POST /services/oauth2/token HTTP/1.1!
Host: login.salesforce.com!
Content-Type: application/x-www-form-urlencoded!
!
grant_type=authorization_code&!
code=aPrxsmIEeqM9PiSOCErbySxQvb...5sdWyjE.DG_TNeow==&!
client_id=3MVG9lKcPoNINVBLWJnB_Y...Lsn&!
client_secret={client_secret}&!
redirect_uri=https%3A%2F%2Fwww.example.com%2Foauth
%2Fcallback!

24. #forcewebinar
OpenID Connect – Basic Client Profile
End-UserClient Auth Server
Authenticate End-User
Credentials/Constent
Redirect to Client
Authorization Response
Token Request
Token Response
Redirect with Authz Request
Authorization Request
{!
"id": "https://login.salesforce.com/id/
00Dx0000000A9y0EAC/005x0000000UnYmAAK",!
"issued_at": "1396919485288",!
"scope": "id full api openid refresh_token chatter_api",!
"instance_url": "https://na1.salesforce.com",!
"token_type": "Bearer",!
"access_token": "00D...u7Bpj72Q.SVBtEBjMK9kLPJWQibME_5M”, !
"refresh_token": "5Aep8614iLM.D...1UAD1OoIkStoE7T",!
"id_token": "eyJ...fDXFOfHr0h02sn32pkyN6UPkQr.n_3YkyGEar
GSlP5ptcTaroqMxZJvodKc1Y693SJPL2u...CeS8x.1F_zeFx8cEA6HEK",!
"signature": "z9F5OBkazrIOy/i7mQ7kZwBkEVHBxjb8+5XPvnlk=",!
}!

25. #forcewebinar
OpenID Connect – Basic Client Profile
End-UserClient Auth Server
Authenticate End-User
Credentials/Constent
Redirect to Client
Authorization Response
Token Request
Token Response
Redirect with Authz Request
Authorization Request
{!
"exp": 1396919605,!
"sub": "https://login.salesforce.com/id/
00Dx0000000A9y0EAC/005x0000000UnYmAAK",!
"aud": "3MVG9lKcPoNINVBLWJnB_Y...Lsn",!
"iss": "https://login. salesforce.com",!
"iat": 1396919485!
}!

26. #forcewebinar
OpenID Connect – Basic Client Profile
End-UserClient Auth Server
Authenticate End-User
Credentials/Constent
Redirect to Client
Authorization Response
Token Request
Token Response
UserInfo Request
Redirect with Authz Request
Authorization Request
GET /services/oauth2/userinfo HTTP/1.1!
Host: login.salesforce.com!
Authorization: Bearer 00D...u7Bpj72Q.SBtEBjMK9kLPJWQibME_5M!

27. #forcewebinar
OpenID Connect – Basic Client Profile
End-UserClient Auth Server
Authenticate End-User
Credentials/Constent
Redirect to Client
Authorization Response
Token Request
Token Response
UserInfo Request
UserInfo Response
Redirect with Authz Request
Authorization Request
{!
"sub": "https://login.salesforce.com/id/00Dx0000000A9y0EAC/
005x0000000UnYmAAK",!
"user_id": "005x0000000UnYmAAK",!
"organization_id": "00Dx0000000A9y0EAC",!
"preferred_username": ”user@example.com",!
"nickname": ”user",!
"name": "Pat Patterson",!
"email": "user@example.com",!
"email_verified": true,!
"given_name": "Pat",!
"family_name": "Patterson",!
...!
}!

28. OpenID Connect:
How do I get started?

29. #forcewebinar
OpenID Connect Stack within Salesforce
Auth. Providers ConnectedApps
§ Client side implementation
– Oauth & OpenID Connect
§ Configure our client, to become your
app, with any provider
§ Fine-grained control over
– just-in-time provisioning
– account linking
§ Server Side Implementation
§ Oauth & OpenID Connect (and SAML and Canvas)
§ Configure your client, to talk to our
services, using your brand or ours
§ Fine-grained control over
– Authorization
– Authentication Levels
– Refresh Token Decay
– Application Policy
– Attributes

30. OpenID Connect:
What can I build?

31. Acquire Customers
With Social Sign-On

32. Run your own
Social Sign-On

33. Rapidly Build & Deploy
Mobile Apps

34. OpenID Connect:
What’s New?

35. #forcewebinar
What’s New?
§ OpenID Connect Services
– Standard schema via User Profile service
– Signature based client authentication
– Custom Attributes
§ ID Tokens
– Signed JWT
– Key Endpoint

36. OpenID Connect:
What’s Next?

37. #forcewebinar
What’s Next?
§ Custom Permissions
– Define your own Permissions
– Manage your Authorization Model using Profile and Permission Sets
§ Customizable ID Tokens
– Identity for the Internet of Things
– Combine Device Identity with Customer Identity
– Design Center
• Scalable
• Offline
• Spectrum of Authentication
• Fine Scoping and Delegation

38. OpenID Connect:
How do I learn more?

39. #forcewebinar
Resources
§ Digging Deeper into Oauth 2.0 on Force.com
– http://wiki.developerforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com
§ Inside OpenID Connect
– http://wiki.developerforce.com/page/Inside_OpenID_Connect_on_Force.com
§ OpenID Connect Playground
– https://openidconnect.herokuapp.com
§ Videos:
– Social Sign-On: http://www.youtube.com/watch?v=D0YUTb-w1Yc
– Mobile Access Management: http://www.youtube.com/watch?v=UYDdmWhiwYw

40. Survey
Your feedback is crucial to the success
of our webinar programs. Thank you!
http://bit.ly/openidsurvey
#forcewebinar

41. Q & A
#forcewebinar
Pat Patterson
Developer Evangelist Architect
@metadaddy
Chuck Mortimore
Vice President, Identity
@cmort
Ian Glazer
Senior Director, Identity
@iglazer