OpenID Connect with
Neos and Flow
by Robert Lemke
Robert Lemke
Flownative Managing Partner
Neos Project Founder
robert@flownative.com
@robertlemke
OpenID Connect
is an authentication
framework based on
OAuth 2.0
Authentication
confirm an entity's
identity
Authorization
verify an entity's
permissions
Authentication &
Authorization
Identity Provider
Identity Token
as a JSON Web Token
# JWT example
eyJraWQiOiJkZmViZTVlNy00MjMyLTQ0NjQtOGYyZS0xNTE
2ODFhMGQxNzMiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1Ni
J9.eyJpc3MiOiJodHRwczovL2lkLmV4YW1wbGUuY29tIiwi
YXVkIjoiQCFEREQ1LjM3MEQuODU0Ny5GRkQ5ITAwMDEhQTF
DOS45MkMxITAwMDghMTNEQi41NEQ4LjY1REUuMjc2MSIsIm
V4cCI6MTU1OTIwNTU2MCwiaWF0IjoxNTU5MjAxOTYwLCJhd
XRoX3RpbWUiOjE1NTkyMDE5NTksImF0X2hhc2giOiJfU1BH
dHM1OUlTbFdNSHhzMmEwM3N3Iiwib3hPcGVuSURDb25uZWN
0VmVyc2lvbiI6Im9wZW5pZGNvbm5lY3QtMS4wIiwic3ViIj
oiVVdBWWZ6em1jYU5BWnlfQzhhOFVvVXhNbWhUMUlsY0tsW
Ec4VG5Xa3lJTSJ9.VsOdosHuRWVaoacWG1CNJl0IZrHH-
HbFTCZDcQDtFPSma13sHO-
C69tm_HTjHX5DnMX6B_lDCgu3A8AsSZIQEG71z_Mnd2uxHo
UrKUtHr8iM9bhpPKMnaXx9jr0O1EtKAJDLkz4qdzNunyOU7
Ud94Lc8YxIjf7FZH_-jJc0UqFyFKY2rdEiZQVATNG94F-
# JWT example
eyJraWQiOiJkZmViZTVlNy00MjMyLTQ0NjQtOGYyZS0xNTE
2ODFhMGQxNzMiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1Ni
J9.eyJpc3MiOiJodHRwczovL2lkLmV4YW1wbGUuY29tIiwi
YXVkIjoiQCFEREQ1LjM3MEQuODU0Ny5GRkQ5ITAwMDEhQTF
DOS45MkMxITAwMDghMTNEQi41NEQ4LjY1REUuMjc2MSIsIm
V4cCI6MTU1OTIwNTU2MCwiaWF0IjoxNTU5MjAxOTYwLCJhd
XRoX3RpbWUiOjE1NTkyMDE5NTksImF0X2hhc2giOiJfU1BH
dHM1OUlTbFdNSHhzMmEwM3N3Iiwib3hPcGVuSURDb25uZWN
0VmVyc2lvbiI6Im9wZW5pZGNvbm5lY3QtMS4wIiwic3ViIj
oiVVdBWWZ6em1jYU5BWnlfQzhhOFVvVXhNbWhUMUlsY0tsW
Ec4VG5Xa3lJTSJ9.VsOdosHuRWVaoacWG1CNJl0IZrHH-
HbFTCZDcQDtFPSma13sHO-
C69tm_HTjHX5DnMX6B_lDCgu3A8AsSZIQEG71z_Mnd2uxHo
UrKUtHr8iM9bhpPKMnaXx9jr0O1EtKAJDLkz4qdzNunyOU7
Ud94Lc8YxIjf7FZH_-jJc0UqFyFKY2rdEiZQVATNG94F-
header
payload
signature
# JWT example
{"kid":"dfebe5e7-4232-4464-8f2e-151681a0d173","
typ":"JWT","alg":"RS256"}
{"iss":"https://id.example.com","aud":"@!
DDD5.370D.8547.FFD9!0001!A1C9.92C1!0008!
13DB.54D8.65DE.2761","exp":1559205560,"iat":155
9201960,"auth_time":1559201959,"at_hash":"_SPGt
s59ISlWMHxs2a03sw","oxOpenIDConnectVersion":"op
enidconnect-1.0","sub":"UWAYfzzmcaNAZy_C8a8UoUx
MmhT1IlcKlXG8TnWkyIM"}
VÝ???EeZ??P?&]f???v?L&Cq???k]????f?t?~C????C
??,I?n???'wk??+)KG?Ȍ??i<?'i|}???KJ?˓>*w3n?#??
G}?<c#?Y??%???)??tH?AP4ox?X+?Y?n;L"??T??
header
payload
signature
Scope
OIDC Discovery
Bearer Access Token
Authenticate
Web Users
DEMO
Authenticate
Applications
Roles from
Identity Token
robert@flownative.com
www.flownative.com
@robertlemke

OpenID Connect with Neos and Flow