OAuth2 Primer

Slides from the tech talk at Marqeta HQ.

Transcript

1. OAuth2 Primer Manish Pandit 03/19/2018
5. OAuth Primer The Need OAuth as a Standard OAuth in Practice
6. Identity and Authorization I want TurboTax to pull my trades from Fidelity
7. But... I do not want to give my Fidelity password to TurboTax I do not want TurboTax to pull anything other than trades I want the ability to revoke TurboTax’s access to my Fidelity Account
8. So.. Access Keys Whitelisting HTTP Basic Screen Scraping with stored credentials Wide open access/No authorization
9. And there is more.. Mobile IoT Devices Service to Service Client-Server Applications Rich Client Applications
10. Need for.. A secure standard for access authorization without the password leaving the site where the protected data is. Short-lived tokens in lieu of passwords to access information. A standard that works across all the API access patterns.
12. OAuth 2.0 OAuth is an open standard for access delegation, commonly used as a way for Internet users to grant websites or applications access to their information on other websites but without giving them the passwords. (Wikipedia) OAuth 2.0 relies on HTTP over TLS OAuth is an authorization protocol, and NOT an authentication protocol. * I still have bad dreams about OAuth 1.0 and 1.0a
13. ..and many, many more!
14. Coming soon..
15. Terminology The OAuth spec outlines the basic terms that build upon the standard. • Resource Owner • Resource Server • Client • Authorization Server
16. Connecting the dots Resource Owner is the user whose resources (data) exists on a Resource Server. The Resource Owner grants access to a Client to access these resources, by authorizing access to those resources on an Authorization Server where his identity exists and can be authenticated. The Client then gets credentials from the Authorization Server that can be used on the Resource Owner’s behalf to access the resources on the Resource Server.
17. Authorization Examples A Twitter desktop client posting tweets on your behalf MyFitnessPal getting your Step Count from your Fitbit Account Turbotax getting your trades from your Fidelity Account Instacart Servers calling Marqeta’s API Facebook iOS app accessing your Facebook account Single Page App (RCA) accessing your News Aggregator
18. OAuth 2.0 Constructs Client ID Client Secret Scope Grant Type Access Token Refresh Token
19. Client ID and Client Secret Identify the client which could be an web application, a single page app, a native mobile app, or a server
20. Grant Type Steps that define the authorization protocol, resulting in an access token.
21. Access Tokens Short lived (hours, days, weeks, months?), bearer tokens that the client can use to act on behalf of the resource owner.
22. Refresh Tokens Long lived tokens, used to request a new access token upon expiry of the current one, without Resource Owner intervention.
23. Scope Scopes define the which resources can be accessed by the client using the access token. Scopes can be sliced and diced in many ways - Read vs. Write, Functionality based, Default, etc. Be careful defining them - you’ll end up with an LDAP ACLs. Scopes <> ACL.
24. Authorization Code Grant For client/server web applications, also known as delegated authentication. Also known as 3-legged OAuth. Quiz - Guess the 3 legs
25. Authorization Code Grant Flow 1. The client redirects the resource owner to the authorization server by passing in the response_type=code, redirect_uri, scope, and client_id. 2. The authorization server asks the resource owner for his credentials, MFA may be performed here. 3. The authorization server asks the resource owner to pick scopes that the client will be authorized for. 4. Upon the resource owner granting access, the authorization server sends a short lived authorization code to the redirect_uri 5. The client uses this authorization code to do a POST on the authorization server, passing in client_id, client_secret, and grant_type=authorization_code. 6. The client receives a refresh token and and access token.
26. Demo – CapitalOne Rewards
27. Implicit Grant For Single Page Apps, or Desktop Clients, or Browser Extensions.. There is no client_secret since the client cannot keep the secret. A simplified version of Authorization Code Grant. A refresh token is not returned in the response. Never, ever used in Financial Systems.
28. Implicit Grant Flow 1. Client redirects the resource owner to the authorization URL same as Authorization Code Flow, except response_type is token (vs. code), and grant_type is not passed. 2. Upon the access being granted by the resource owner, an Access Token is provided to the client.
29. Resource Owner Password Grant For fully trusted clients, like Native Mobile Apps provided by the Resource Server who is also the Identity Server. The only grant type where a user’s credentials are passed in the token request. Also known as Password Grant
30. Resource Owner Password Grant Flow 1. Client sends request to the Authorization server as a POST with grant_type=password, client_id, client_secret, scope, username, and password. 2. The Authorization Server responds with an access token and a refresh token.
31. Client Credentials Grant For server to service, or machine to machine, or service to service call. There is no identity involved. Also known as 2-legged OAuth. A refresh token is not returned. Simplest of all grant types. Additional security via whitelisting and firewalling can be implemented.
32. Client Credentials Grant Flow 1. Client sends a POST request to the authorization server with client_id, client_secret, grant_type=client_credentials and scope. 2. Authorization server returns an access token to the client.
33. Demo – CapitalOne Credit Offers
34. Source: https://auth0.com/docs/api-auth/which-oauth-flow-to-use
35. References The OAuth2 Spec, RFC 6749 https://tools.ietf.org/html/rfc6749 The OAuth Bible http://oauthbible.com/ A Guide to OAuth2 Grant Types https://alexbilbie.com/guide-to-oauth-2-grants/