What's New with OAuth and OpenID Connect - API Days Australia

11954e59b49809173d48133ec4047fce?s=47 Aaron Parecki
September 15, 2020
Technology
0
8

What's New with OAuth and OpenID Connect - API Days Australia

https://aaronparecki.com/2020/09/16/23/

11954e59b49809173d48133ec4047fce?s=128

Aaron Parecki

September 15, 2020
Tweet

More Decks by Aaron Parecki

See All by Aaron Parecki
11954e59b49809173d48133ec4047fce?s=48 aaronpk
0
29
11954e59b49809173d48133ec4047fce?s=48 aaronpk
0
110
11954e59b49809173d48133ec4047fce?s=48 aaronpk
0
260
11954e59b49809173d48133ec4047fce?s=48 aaronpk
0
46
11954e59b49809173d48133ec4047fce?s=48 aaronpk
0
24
11954e59b49809173d48133ec4047fce?s=48 aaronpk
0
90
11954e59b49809173d48133ec4047fce?s=48 aaronpk
0
87
11954e59b49809173d48133ec4047fce?s=48 aaronpk
0
170
11954e59b49809173d48133ec4047fce?s=48 aaronpk
0
24

Other Decks in Technology

See All in Technology
53e2d354b3299d64a54af680865516d5?s=48 satotakeshi
3
690
26173c2f52b5aa5d06e6806c7a9478d3?s=48 laprasdrum
0
990
0e742980c48d689f31700b208f22fd5a?s=48 k_koheyi
3
450
C786d7772602b488a7972c38c143f61c?s=48 con_mame
3
1.8k
79c2f7db29ee6df3e1ceb85c6a0126d3?s=48 moriwaka
0
130
5059d3f370ad7e1f4d8de4be79ae1a2c?s=48 rvirus0817
2
360
0af658ea4f11fa7bf803115451890d4c?s=48 ararajp
2
600
2102a6b8760bd6f57f672805723dd83a?s=48 line_developers_tw
0
1.4k
5059d3f370ad7e1f4d8de4be79ae1a2c?s=48 rvirus0817
1
150
40301c0affdf359eaca771713e22b71a?s=48 harshbothra
0
400
B46a00cafe34a9437d3a5bc6afc5bee3?s=48 aditya45
0
470
41088d50c95ab57359a3cb56988cfec7?s=48 ngyt
2
630

Featured

See All Featured
2f5463832ccb768ccb4a1ca3607c27ef?s=48 jacobian
251
19k
9375a9529679f1b42b567a640d775e7d?s=48 schacon
144
6.5k
61857dafbd287b3027c4dcea9008ad3c?s=48 carmenhchung
18
920
E837d2996f52008ace055a08fbfff992?s=48 frogandcode
121
20k
11c84dff30266b907714802088852677?s=48 jasonvnalue
80
7.9k
3ab1249be442027903e1180025340b3f?s=48 reverentgeek
165
6.8k
Ded01cdab114abe4ec13511e4c25b9bb?s=48 andyhume
60
2.4k
C51b39fa3c79ccb99dcb8a076bc98287?s=48 brianwarren
82
4.6k
5f2da528927a2ec9ba4fec2069cbc958?s=48 kneath
218
14k
Fe6b81005d1553accd6b2a28f6a2bef1?s=48 phodgson
85
3.8k
F29327647a9cff5c69618bae420792ea?s=48 tenderlove
49
3.2k
F68cb25ae3e5c2106997454b13b7737d?s=48 brad_frost
153
6.2k

Transcript

  1. What's New in OAuth 2.1 Aaron Parecki Senior Security Architect,

    Okta API Days Australia • September 2020

  2. @aaronpk September 2020 oauth.net/2

  3. @aaronpk September 2020 OAuth 2.0 RFC6749 OAuth Core Authorization Code

    Implicit Password Client Credentials Grant Types

  4. @aaronpk September 2020

  5. @aaronpk September 2020 OAuth 2.0 RFC6749 OAuth Core Authorization Code

    Implicit Password Client Credentials Grant Types RFC6750 Bearer Tokens Token Usage Tokens in HTTP Header Tokens in POST Form Body Tokens in GET Query String

  6. @aaronpk September 2020

  7. @aaronpk September 2020 OAuth Server OAuth Client Passing Data via

    the Front Channel Did they catch 
 it? Did someone else 
 steal it? Is this really 
 from the real 
 OAuth server?

  8. @aaronpk September 2020 OAuth 2.0 RFC6749 OAuth Core Authorization Code

    Implicit Password Client Credentials RFC6750 Bearer Tokens RFC7636 +PKCE Tokens in HTTP Header Tokens in POST Form Body Tokens in GET Query String

  9. @aaronpk September 2020 OAuth 2.0 RFC6749 OAuth Core Authorization Code

    Implicit Password Client Credentials RFC6750 Bearer Tokens RFC7636 +PKCE RFC8252 PKCE for mobile Tokens in HTTP Header Tokens in POST Form Body Tokens in GET Query String

  10. @aaronpk September 2020 OAuth 2.0 RFC6749 OAuth Core Authorization Code

    Implicit Password Client Credentials RFC6750 Bearer Tokens RFC7636 +PKCE RFC8252 PKCE for mobile Browser App BCP PKCE for SPAs Tokens in HTTP Header Tokens in POST Form Body Tokens in GET Query String

  11. @aaronpk September 2020

  12. @aaronpk September 2020 https://example.com https://app.example.com https://auth.example GET / HTML, CSS,

    etc POST /token access token CORS

  13. @aaronpk September 2020 caniuse.com/cors

  14. @aaronpk September 2020 OAuth 2.0 RFC6749 OAuth Core Authorization Code

    Implicit Password Client Credentials RFC6750 Bearer Tokens RFC7636 +PKCE RFC8252 PKCE for mobile Browser App BCP PKCE for SPAs Tokens in HTTP Header Tokens in POST Form Body Tokens in GET Query String

  15. @aaronpk September 2020 OAuth 2.0 RFC6749 OAuth Core Authorization Code

    Implicit Password Client Credentials RFC6750 Bearer Tokens RFC7636 +PKCE RFC8252 PKCE for mobile Browser App BCP PKCE for SPAs Tokens in HTTP Header Tokens in POST Form Body Tokens in GET Query String

  16. @aaronpk September 2020 OAuth 2.0 for Browser-Based Apps

  17. @aaronpk September 2020 OAuth 2.0 for Browser-Based Apps

  18. @aaronpk September 2020 OAuth 2.0 RFC6749 OAuth Core Authorization Code

    Implicit Password Client Credentials RFC6750 Bearer Tokens Tokens in HTTP Header Tokens in POST Form Body Tokens in GET Query String RFC7636 +PKCE RFC8252 PKCE for mobile Browser App BCP PKCE for SPAs PKCE for confidential clients Security BCP

  19. @aaronpk September 2020 Password oauth.net/2/oauth-best-practice

  20. @aaronpk September 2020 Password oauth.net/2/oauth-best-practice • Added to OAuth to

    enable migrating applications from HTTP Basic Auth or using a stored password to OAuth

  21. @aaronpk September 2020 OAuth 2.0 Security BCP • All OAuth

    clients MUST use PKCE with the authorization code flow • Password grant MUST NOT be used • Use exact string matching for redirect URIs • No access tokens in query strings • Refresh tokens for public clients must be 
 sender-constrained or one-time use oauth.net/2/oauth-best-practice

  22. @aaronpk September 2020 RFC6749 RFC6750 CLIENT TYPE AUTH GRANT TYPE

    RFC6819 RFC7009 RFC7592 RFC7662 RFC7636 RFC7591 RFC7519 BUILDING YOUR APPLICATION RFC8252 OIDC RFC8414 STATE TLS CSRF UMA 2 FAPI RFC7515 RFC7516 RFC7517 RFC7518 TOKEN POP SECURITY BCP CIBA HTTP SIGNING MUTUAL TLS SPA BCP JARM JAR TOKEN DPOP PAR

  23. @aaronpk September 2020 OAuth 2.0 RFC6749 OAuth Core Authorization Code

    Implicit Password Client Credentials RFC6750 Bearer Tokens Tokens in HTTP Header Tokens in POST Form Body Tokens in GET Query String RFC7636 +PKCE RFC8252 PKCE for mobile Browser App BCP PKCE for SPAs PKCE for confidential clients Security BCP

  24. @aaronpk September 2020 OAuth 2.1 Authorization Code Client Credentials +PKCE

    Tokens in HTTP Header Tokens in POST Form Body

  25. OAuth 2.1 oauth.net/2.1

  26. @aaronpk September 2020 OAuth 2.1 Consolidate the OAuth 2.0 specs,


    adding best practices, 
 removing deprecated features Capture current best practices in OAuth 2.0 under a single name Add references to extensions that didn't exist when OAuth 2.0 was published

  27. @aaronpk September 2020 OAuth 2.1 No new behavior defined by

    OAuth 2.1 Non-Goals: Don't include anything experimental, 
 in progress or not widely implemented

  28. @aaronpk September 2020 OAuth 2.1 Authors: Dick Hardt, Aaron Parecki,

    Torsten Lodderstedt • OAuth 2.1 is a consolidation of: 
 OAuth 2.0 (RFC6749), Native Apps BCP (RFC8252), PKCE (RFC7636), Browser-Based Apps BCP (draft), Security BCP (draft), 
 Bearer Tokens (RFC6750) • Grant types defined: Authorization Code with PKCE, Client Credentials • Exact redirect URI matching • No Bearer tokens in query strings • Refresh tokens for SPAs must be sender-constrained or one-time use • Implicit and password grants are omitted

  29. @aaronpk September 2020 OAuth 2.1 Client Types Public Confidential

  30. @aaronpk September 2020 OAuth 2.1 Client Types Public Confidential Credentialed

  31. @aaronpk September 2020 Credentialed Client This distinction already exists in

    OAuth 2.0! OAuth 2.0: If the client type is confidential or the client was issued client credentials, the client MUST authenticate... OAuth 2.1: Confidential or credentialed clients MUST authenticate...

  32. @aaronpk September 2020 Credentialed Client • A client that has

    credentials, but whose identity is not confirmed • e.g. a client that obtains a client secret via dynamic client registration

  33. @aaronpk September 2020 OAuth 2.1 oauth.net/2.1 tools.ietf.org/html/draft-ietf-oauth-v2-1 Recently adopted by

    the OAuth Working Group

  34. Thank you! @aaronpk aaronpk.com oauth.wtf