Download to read offline
Uploaded byMichae Blakeney
Securing APIs with oAuth2
The document discusses OAuth 2.0, an authorization framework that enables third-party applications to obtain limited access to HTTP services. It outlines various components including resource owner, resource server, client, and authorization server, as well as different authorization flows like client credentials and authorization code grants. Use cases for API access include server-to-server communication and mobile application sales for agents.
More Related Content
Similar to Securing APIs with oAuth2
Securing APIs with oAuth2
- 1. Securing APIs withoAuth2
- 2. Securing APIs with oAuth2 UseCase 2 – Mobile App Use Case 1 – Server to Server What is oAuth2?
- 3. PROPRIETARY AND CONFIDENTIAL Whatis oAuth2? "The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf." - RFC 6749 3
- 4. PROPRIETARY AND CONFIDENTIAL Anentity capable of granting access to a protected resource. What is oAuth2? 4 Resource Owner The server hosting the protected resources, capable of accepting and responding to protected resource requests using access tokens. Resource Server An application making protected resource requests on behalf of the resource owner and with its authorization. Client The server issuing access tokens to the client after successfully authenticating the resource owner and obtaining authorization. Authorization Server
- 5. PROPRIETARY AND CONFIDENTIAL Whatis oAuth2? • Authorization Code • Implicit • Resource Owner Password Credentials • Client Credentials 5 Authorization Flows
- 6. PROPRIETARY AND CONFIDENTIAL ThreeHour Boat Tour Travel Insurance, LLC est. 1965
- 7. PROPRIETARY AND CONFIDENTIAL Franchiseservers need to have API access to the data so that the offices can report on their sales data. Business would like to deploy a mobile app for agents to use to make sales while trolling the docks. Use Cases 7 Server to Server Mobile Sales App
- 8. PROPRIETARY AND CONFIDENTIAL UseCase 1 – Server to Server 8
- 9. PROPRIETARY AND CONFIDENTIAL WorkerApp Demo 9
- 10. PROPRIETARY AND CONFIDENTIAL UseCase 1 – Server to Server • Client Credentials Flow, RFC 6749 section 4.4 • Bearer tokens, RFC 6750 • Json Web Tokens, RFC 7519 • HS256 and RS256 signatures, RFC 7518 • Using .well_known, RFC 5785, and OpenID Connect Discovery 1.0 • Json Web Key, draft-ietf-jose-json-web-key-41
- 11. PROPRIETARY AND CONFIDENTIAL UseCase 2 – Mobile Application 11
- 12. PROPRIETARY AND CONFIDENTIAL WebApp Demo 12
- 13. PROPRIETARY AND CONFIDENTIAL UseCase 2 – Mobile App • Authorization Code Grant Flow, RFC 6749 section 4.1 • Access Token Scope, RFC 6749 section 3.3 • Scopes should be actions on resources • Scopes define the permissions delegated to a client on behalf of the user • Refresh Tokens, OpenId Connect Core 1.0 section 11 Offline Access • For additional security consider PKCE , RFC 7636
Editor's Notes
- #5 Resource Owner: When the resource owner is a person, it is referred to as an end-user. Client: The term "client" does not imply any particular implementation characteristics (e.g., whether the application executes on a server, a desktop, or other devices).
- #9 POST {Token Endpoint} HTTP/1.1 Host: {Authorization Server} Authorization: Basic {Client Credentials} Content-Type: application/x-www-form-urlecodedgrant_type=client_credentials // - Required &scope={Scopes}
- #12 GET {Authorization Endpoint} ?response_type=code // - Required &client_id={Client ID} // - Required &redirect_uri={Redirect URI} // - Conditionally required &scope={Scopes} // - Optional &state={Arbitrary String} // - Recommended &code_challenge={Challenge} // - Optional &code_challenge_method={Method} // - Optional HTTP/1.1 HOST: {Authorization Server} POST {Token Endpoint} HTTP/1.1 Host: {Authorization Server} Content-Type: application/x-www-form-urlencodedgrant_type=authorization_code // - Required &code={Authorization Code} // - Required &redirect_uri={Redirect URI} // - Required if the authorization // request included 'redirect_uri'. &code_verifier={Verifier} // - Required if the authorization // request included // 'code_challenge'.