Download as PDF, PPTX
![#RESTSecurity @otaviojava @tomitribe
ODCTour18LAD ∙ { "alg": “RS256", "typ": “JWT" }
∙ {
"token-type": "access-token",
"username": "snoopy",
"animal": "beagle",
"iss": "https://demo.superbiz.com/oauth2/token",
"scopes": [
“twitter”, "mans-best-friend"
],
"exp": 1474280963,
"iat": 1474279163,
"jti": "66881b068b249ad9"
}
∙ DTfSdMzIIsC0j8z3icRdYO1GaMGl6j1I_2DBjiiHW9vmDz8OAw8Jh8DpO32fv0vI
Cc0hb4F0QCD3KQnv8GVM73kSYaOEUwlW0k1TaElxc43_Ocxm1F5IUNZvzlLJ
_ksFXGDL_cuadhVDaiqmhct098ocefuv08TdzRxqYoEqYNo](https://image.slidesharecdn.com/statelessmicroservicesecurityviajwtandmicroprofile-es2-180824151941/75/Stateless-Microservice-Security-via-JWT-and-MicroProfile-Mexico-49-2048.jpg)
Uploaded byOtávio Santana
Stateless Microservice Security via JWT and MicroProfile - Mexico
The document discusses security options for stateless microservices, focusing on JWT and OAuth 2.0 as alternatives to basic authentication. It highlights the challenges of basic auth and introduces the structure and functionality of OAuth 2.0, including password grants and token management. Additionally, it explains how JSON Web Tokens (JWT) improve security through encoding and signing mechanisms.
More Related Content
Similar to Stateless Microservice Security via JWT and MicroProfile - Mexico
![[OSSParis 2015] The OpenID Connect Protocol](https://cdn.slidesharecdn.com/ss_thumbnails/poss2015openidconnect-151120084012-lva1-app6891-thumbnail.jpg?width=640&height=640&fit=bounds)
![Architecting Cloud Computing Solutions with Java [1.1]](https://cdn.slidesharecdn.com/ss_thumbnails/architectingcloudcomputingsolutionswithjava-200728160449-thumbnail.jpg?width=640&height=640&fit=bounds)
![Jakarta EE Meets NoSQL in the Cloud Age [DEV6109]](https://cdn.slidesharecdn.com/ss_thumbnails/jakarta-nosql-cloud-181025142320-thumbnail.jpg?width=640&height=640&fit=bounds)
![Let’s Make Graph Databases Fun Again with Java [DEV6043]](https://cdn.slidesharecdn.com/ss_thumbnails/graph-181025142147-thumbnail.jpg?width=640&height=640&fit=bounds)
![Eclipse JNoSQL: One API to Many NoSQL Databases - BYOL [HOL5998]](https://cdn.slidesharecdn.com/ss_thumbnails/jnosqlhol2018-181025141725-thumbnail.jpg?width=640&height=640&fit=bounds)
Stateless Microservice Security via JWT and MicroProfile - Mexico
- 1. ODCTour18LAD #RESTSecurity @otaviojava @tomitribe StatelessMicroservice Security via JWT and MicroProfile ∙ Otávio Santana @otaviojava ∙ Tomitribe
- 2. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD OtávioSantana ∙Senior Software Engineer at Tomitribe ∙Java Champion & Developer Champion ∙Duke’s Choice Award 2016 y 2017 ∙Apache and Eclipse Commiter
- 3. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD “Lomejor de los standares es que terminas teniendo muchas opciones por escoger.” - Andrew S. Tanenbaum
- 4. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD “Lomejor de los standares es que terminas teniendo muchas opciones por escogerThe nice thing about standards is you have so many to choose from.” - Andrew S. Tanenbaum
- 5. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD Opcionesde seguridad para Microservicios ● Más allá de Basic Auth ● Teoría de OAuth 2.0 ● Introducción a JWT ● Eclipse Microprofile ● Demo
- 6. #RESTSecurity @otaviojava @tomitribe ODCTour18LADLínea Base 1000 usuarios x 3 TPS 4 saltos 3000 TPS frontend 12000 TPS backend
- 7. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD BasicAuth (y sus problemas)
- 8. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD Mensajeen Basic Auth POST /painter/color/object HTTP/1.1 Host: localhost:8443 Authorization: Basic c25vb3B5OnBhc3M= User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 45 {"color":{"b":255,"g":0,"name":"blue","r":0}}
- 9. #RESTSecurity @otaviojava @tomitribe ODCTour18LADBasic Auth Password Sent 3000 TPS (HTTP+SSL) username+password Base64 (no auth) (LDAP) 12000 TPS (HTTP) 3000 TPS
- 10. #RESTSecurity @otaviojava @tomitribe ODCTour18LADBasic Auth Password Sent 3000 TPS (HTTP+SSL) username+password Base64 username+password Base64 15000 TPS (LDAP) Password Sent 12000 TPS (HTTP)
- 11. #RESTSecurity @otaviojava @tomitribe ODCTour18LADBasic Auth Password Sent 3000 TPS (HTTP+SSL) username+password Base64 Lista Blanca de IP 3000 TPS (LDAP) 12000 TPS (HTTP)
- 12. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD “Dametoda la información del salario de José.” “No se quien eres, … pero por supuesto!”
- 13. #RESTSecurity @otaviojava @tomitribe ODCTour18LADAtaque de fuerza bruta: Basic Auth Password válidos 3000 TPS (HTTP+SSL) Lista Blanca IP 9000 TPS (LDAP) 12000 TPS (HTTP) Passwords inválidos 6000 TPS (HTTP+SSL)
- 14. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD OAuth2.0 (y sus problemas)
- 15.
- 16.
- 17.
- 18.
- 19. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD OAuth2 - Password Grant (LDAP) (Repositorio de Token) Verificación de Password Generación de Token Post /oauth2/token Host: api.superbliz.io User-Agent: curl/7.43.0 Accept: */* Content-Type: application/x-www-form-urlencoded Content-Length: 54 grand_type=password&username=snoopy&password=woodstock
- 20. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD OAuth2 - Password Grant (LDAP) Verificación de Password Generación de Token (Repositorio de Token) Post /oauth2/token Host: api.superbliz.io User-Agent: curl/7.43.0 Accept: */* Content-Type: application/x-www-form-urlencoded Content-Length: 54 grand_type=password&username=snoopy&password=woodstock
- 21. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD MensajeOAuth 2.0 POST /painter/color/object HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 45 {"color":{"r":0,"g":0,"b":255,"name":"blue"}}
- 22. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD MensajeOAuth 2.0 POST /painter/color/palette HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 45 {"color":{"r":0,"g":255,"b":0,"name":"green"}}
- 23. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD MensajeOAuth 2.0 POST /painter/color/select HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 44 {"color":{"r":255,"g":0,"b":0,"name":"red"}}
- 24. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD MensajeOAuth 2.0 POST /painter/color/fill HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 49 {"color":{"r":0,"g":255,"b":255,"name":"yellow"}}
- 25. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD MensajeOAuth 2.0 POST /painter/color/stroke HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 49 {"color":{"r":255,"g":200,"b":255,"name":"orange"}}
- 26.
- 27. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD OAuth2 - Refresh Grant (LDAP) Verificación Password Generación Token (Repositorio de Token) Post /oauth2/token Host: api.superbliz.io User-Agent: curl/7.43.0 Accept: */* Content-Type: application/x-www-form-urlencoded Content-Length: 54 grand_type=password&username=snoopy&password=woodstock
- 28. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD OAuth2 - Refresh Grant (LDAP) Verificación Password Generación Token (Repositorio de Token) Post /oauth2/token Host: api.superbliz.io User-Agent: curl/7.43.0 Accept: */* Content-Type: application/x-www-form-urlencoded Content-Length: 54 grand_type=password&username=snoopy&password=woodstock
- 29. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD Paranterior ∙ Access Token 2YotnFZFEjr1zCsicMWpAA ∙ Refresh Token tGzv3JOkF0XG5Qx2TlKWIA Nuevo Par ∙ Access Token 6Fe4jd7TmdE5yW2q0y6W2w ∙ Refresh Token hyT5rw1QNh5Ttg2hdtR54e
- 30. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD MensajeOAuth 2.0 POST /painter/color/palette HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 6Fe4jd7TmdE5yW2q0y6W2w User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 46 {"color":{"r":0,"g":255,"b":0,"name":"green"}}
- 31. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD MensajeOAuth 2.0 POST /painter/color/select HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 6Fe4jd7TmdE5yW2q0y6W2w User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 44 {"color":{"r":255,"g":0,"b":0,"name":"red"}}
- 32. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD MensajeOAuth 2.0 POST /painter/color/fill HTTP/1.1 Host: api.superbiz.io Authorization: Bearer 6Fe4jd7TmdE5yW2q0y6W2w User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 49 {"color":{"r":0,"g":255,"b":255,"name":"yellow"}}
- 33. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD ¿Quéhemos logrado?
- 34. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD Ahoratenemos más passwords (al menos tus dispositivos los tienen)
- 35. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD Terminologíade nuevo… ∙ Password Grant??? ∙ Logging in ∙ Token? ∙ Un password ligeramente ofuscado ∙ Equivalente a un HTTP session ID mejorado levemente
- 36. #RESTSecurity @otaviojava @tomitribe ODCTour18LADOAuth 2 Request enviados (Authorization: Bearer …) 3000 TPS (HTTP+SSL) 3000 TPS (Verificacione s de tokens) Password enviados (post oauth2/token …) 1000/daily (HTTP+SSL) OAuth 2 (LDAP) 4 saldos 12000 TPS backend
- 37.
- 38. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD “Quiénes 6Fe4jd7TmdE5y W2q0y6W2w ???????” “No tengo idea. Pregúntale al servidor de tokens.”
- 39. #RESTSecurity @otaviojava @tomitribe ODCTour18LADOAuth 2 Tokens enviados 3000 TPS (HTTP+SSL) 3000 TPS (verificación token) Password Envidados 1000/daily (HTTP+SSL) OAuth 2 (LDAP) 12000 TPS (Verificación token) 8 Saldos 24000 TPS backend
- 40. #RESTSecurity @otaviojava @tomitribe ODCTour18LADOAuth 2 3000 TPS (Verificación token) (LDAP) 12000 TPS (Verificación token) 55% del tráfico total Tokens enviados 3000 TPS (HTTP+SSL) Password Envidados 1000/daily (HTTP+SSL) OAuth 2 8 Saldos 24000 TPS backend
- 41. #RESTSecurity @otaviojava @tomitribe ODCTour18LADOAuth 2 Puntero Puntero Estado
- 42. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD AccessToken Puntero de Acceso? Llave primaria de Acceso?
- 43. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD OAuth2.0 Algoritmo de intercambio de passwords de alta frecuencia?
- 44. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD OAuth2.0 + JSon Web Tokens (JWT)
- 45. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD JSonWeb Token ∙ Pronunciado “YOT” ∙ JSON map con data de usuario ∙ Códificado Base64 ∙ Firmado digitalmente (RSA-SHA256, HMAC-SHA512, etc) ∙ Mecanismo de expiración
- 46. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD Previamenteun Access Token ∙ 6Fe4jd7TmdE5yW2q0y6W2w
- 47. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD AccessToken ahora (JWT) ∙ eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbi10eXBlIjoi YWNjZXNzLXRva2VuIiwidXNlcm5hbWUiOiJzbm9vcHkiLCJhb mltYWwiOiJiZWFnbGUiLCJpc3MiOiJodHRwczovL2RlbW8uc3V wZXJiaXouY29tL29hdXRoMi90b2tlbiIsInNjb3BlcyI6WyJ0d2l0d GVyIiwibWFucy1iZXN0LWZyaWVuZCJdLCJleHAiOjE0NzQyO DA5NjMsImlhdCI6MTQ3NDI3OTE2MywianRpIjoiNjY4ODFiMD Y4YjI0OWFkOSJ9.DTfSdMzIIsC0j8z3icRdYO1GaMGl6j1I_2DB jiiHW9vmDz8OAw8Jh8DpO32fv0vICc0hb4F0QCD3KQnv8GV M73kSYaOEUwlW0k1TaElxc43_Ocxm1F5IUNZvzlLJ_ksFXGD L_cuadhVDaiqmhct098ocefuv08TdzRxqYoEqYNo
- 48. #RESTSecurity @otaviojava @tomitribe ODCTour18LADNuevo Access Token ∙ header (JSON > Base64 URL Encoded) ∙ Describe como la firma (signature) del token puede ser verificada ∙ payload (JSON > Base64 URL Encoded) ∙ Json map de información que desees incluir ∙ Campo estándar como el de Expiración ∙ signature (Binary > Base64 URL Encoded) ∙ La firma digital ∙ Hecha exclusivamente por el endpoint: /oauth2/token ∙ Si es RSA puede ser verificado por cualquier persona
- 49. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD∙ { "alg": “RS256", "typ": “JWT" } ∙ { "token-type": "access-token", "username": "snoopy", "animal": "beagle", "iss": "https://demo.superbiz.com/oauth2/token", "scopes": [ “twitter”, "mans-best-friend" ], "exp": 1474280963, "iat": 1474279163, "jti": "66881b068b249ad9" } ∙ DTfSdMzIIsC0j8z3icRdYO1GaMGl6j1I_2DBjiiHW9vmDz8OAw8Jh8DpO32fv0vI Cc0hb4F0QCD3KQnv8GVM73kSYaOEUwlW0k1TaElxc43_Ocxm1F5IUNZvzlLJ _ksFXGDL_cuadhVDaiqmhct098ocefuv08TdzRxqYoEqYNo
- 50.
- 51.
- 52. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD Ligeropero con alto impacto en la arquitectura
- 53. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD ¿Quétenemos hasta el momento? (repaso)
- 54. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD (LDAP) Datacompleta del usuario desde ldap
- 55. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD (LDAP) Generaciónde Access Token (pointer)
- 56. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD (LDAP) Ambosse insertan en BD
- 57. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD (LDAP) Envíodel Access Token (pointer) hacia el cliente
- 58. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD Resultadofinal cliente permanece con el Pointer Server almacena State
- 59. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD ¿Quépodemos hacer ahora? (hola JWT!)
- 60. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD (LDAP) Datacompleta del usuario desde ldap
- 61. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD (LDAP) Ladata se representa en JSON
- 62. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD (LDAP) JSONes firmado RSA-SHA 256
- 63. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD (LDAP) Seinserta solamente el pointer en DB (para revocaciones)
- 64. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD (LDAP) Envíodel Access Token (estado) hacia el cliente
- 65. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD Servidoralmacena el Puntero Cliente permanece con el Estado Resultado obtenido
- 66.
- 67. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD OAuth2 - Password Grant (LDAP) (Repositorio Token ID) Verifica Password Genera Token Firmado (Signed) Post /oauth2/token Host: api.superbliz.io User-Agent: curl/7.43.0 Accept: */* Content-Type: application/x-www-form-urlencoded Content-Length: 54 grand_type=password&username=snoopy&password=woodstock
- 68. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD OAuth2 - Password Grant (LDAP) Verifica Password (Repositorio Token ID) Genera Token Firmado (Signed)
- 69. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD MensajeOAuth 2.0 con JWT POST /painter/color/palette HTTP/1.1 Host: api.superbiz.io Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbi10eXBlIjoiYWNjZXNzLXR va2VuIiwidXNlcm5hbWUiOiJzbm9vcHkiLCJhbmltYWwiOiJiZWFnbGUiLCJpc3MiOiJodHRwczovL2RlbW8uc3VwZXJ iaXouY29tL29hdXRoMi90b2tlbiIsInNjb3BlcyI6WyJ0d2l0dGVyIiwibWFucy1iZXN0LWZyaWVuZCJdLCJleHAiOjE0NzQ y ODA5NjMsImlhdCI6MTQ3NDI3OTE2MywianRpIjoiNjY4ODFiMDY4YjI0OWFkOSJ9.DTfSdMzIIsC0j8z3icRdYO1GaMGl 6j1I_2DBjiiHW9vmDz8OAw8Jh8DpO32fv0vICc0hb4F0QCD3KQnv8GVM73kSYaOEUwlW0k1TaElxc43_Ocxm1F5IUNZ vzlLJ_ksFXGDL_cuadhVDaiqmhct098ocefuv08TdzRxqYoEqYNo User-Agent: curl/7.43.0 Accept: */* Content-Type: application/json Content-Length: 46 {"color":{"b":0,"g":255,"r":0,"name":"green"}}
- 70. #RESTSecurity @otaviojava @tomitribe ODCTour18LADOAuth 2 + JWT Tokens enviados 3000 TPS (HTTP+SSL) 0.55 TPS (Verificaciones refresh token) OAuth 2 (LDAP) 4 saltos 12000 TPS backend 3000 TPS (verifica firma) 12000 TPS (verifica firma) Password enviados (post oauth2/token …) 1000/daily (HTTP+SSL)
- 71. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD “No!” “Dametoda la información del salario de José.”
- 72. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD “Claro!” “Dametoda la información del salario de José.”
- 73. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD OAuth2 + JWT Envío de Tokens válidos 3000 TPS (HTTP+SSL) IP whitelisting 0.55 TPS (verifica refresh token) Password enviados 1000/daily (HTTP+SSL) (LDAP) 4 saltos 12000 TPS backend 9000 TPS (verifica firma) 12000 TPS (verifica firma) Token inválidos 6000 TPS (HTTP+SSL)
- 74. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD https://connect2id.com/products/nimbus-jose-jwt LibreríaJWT https://github.com/jwtk/jjwt https://github.com/auth0/java-jwt
- 75.
- 76. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD MicroProfile ∙Comunidad Open-Source de la fundación Eclipse ∙ Enfocada en Microservicios bajo JavaEE ∙ Generadora de: Specificaciones, API y TCK. ∙ Implementado por diferentes entidades http://microprofile.io/
- 77. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD MicroProfileJWT MicroProfile 2.0 JAX-RS 2.1JSON-P 1.1CDI 2.0 Config 1.3 Fault Tolerance 1.1 JWT RBAC 1.1 Health Check 1.0 Metrics 1.1 Open Tracing 1.1 Open API 1.0 Rest Client 1.1 JSON-B 1.0 JWT RBAC 1.1 https://microprofile.io/project/eclipse/microprofile-jwt-auth/ Standares de Seguridad ● OAuth 2.0 ● OpenID Connect ● JSON Web Tokens (JWT) Tecnologías Java ● JAX-RS ● CDI ● JSON-P.
- 78.
- 79. #RESTSecurity @otaviojava @tomitribe ODCTour18LAD MoviefunDiagrama de Despliegue Gateway
- 80.