Save 37% off PRO during our Black Friday Sale! »

Introduction to OAuth

Introduction to OAuth

Delivered at the Eduserv Federated Access Management conference 2011 on 9th November 2011

14902eb1dac66b8458ebbb481d80f0a3?s=128

Alex Bilbie

May 30, 2012
Tweet

Transcript

  1. Wednesday, 30 May 12

  2. Alex Bilbie University of Lincoln @alexbilbie Wednesday, 30 May 12

  3. Story time! Wednesday, 30 May 12

  4. I’m a user of a web service Wednesday, 30 May

    12
  5. I own resources on the web service Wednesday, 30 May

    12
  6. For example, personal details Wednesday, 30 May 12

  7. Wednesday, 30 May 12

  8. These resources1 are stored on a resource server 2 1.

    personal details 2. facebook.com Wednesday, 30 May 12
  9. The resource server exposes user resources over an API Wednesday,

    30 May 12
  10. I visit a 3rd party web application Wednesday, 30 May

    12
  11. The 3rd party web app is called a client Wednesday,

    30 May 12
  12. The client1 wants to use my resources2 1. 3rd party

    web app 2. personal details Wednesday, 30 May 12
  13. But the resource server’s API requires user authorisation Wednesday, 30

    May 12
  14. How? Wednesday, 30 May 12

  15. Give the client my password Wednesday, 30 May 12

  16. Give the client my password Wednesday, 30 May 12

  17. So what then? Wednesday, 30 May 12

  18. OAuth Wednesday, 30 May 12

  19. “An open protocol to allow secure API authorisation in a

    simple and standard method from desktop and web applications.” oauth.net Wednesday, 30 May 12
  20. —˛ Wednesday, 30 May 12

  21. User Client Resources Owns Accesses OWNS OWNS S Authorises Wednesday,

    30 May 12
  22. The flow Wednesday, 30 May 12

  23. User clicks “sign in” in the client application Wednesday, 30

    May 12
  24. Wednesday, 30 May 12

  25. The user is redirected to the resource server and asked

    to sign in Wednesday, 30 May 12
  26. Wednesday, 30 May 12

  27. GET /authorise? response_type=code&client_id=12345&redirect_uri= http://client.tld/ redirect&scope=name,email,birthday HTTP/1.1 Host: resource-server.tld Wednesday, 30

    May 12
  28. The resource server clearly tells the user the specific data

    the client wants to access Wednesday, 30 May 12
  29. Wednesday, 30 May 12

  30. User authorises the application and is redirected back to client

    with a authorisation code in the query string Wednesday, 30 May 12
  31. HTTP/1.1 302 Found Location: http://client.tld/redirect?code=78dsf9sudfo9s Wednesday, 30 May 12

  32. Client exchanges the authorisation code for an access token Wednesday,

    30 May 12
  33. POST /token HTTP/1.1 Host: resource-server.tld Content-type: application/x-www-form-urlencoded code=78dsf9sudfo9s&client_id=12345&client_secret =12345&redirect_uri=http://client.tld/redirect Wednesday,

    30 May 12
  34. HTTP/1.1 200 OK Content-type: application/json { access_token: “aLKJHskjhda8s13jsi9sis”, valid_until: 1320759526

    } Wednesday, 30 May 12
  35. The access token can then be used as authorisation by

    the client to access the specified resources for a specific length of time Wednesday, 30 May 12
  36. Advantages Wednesday, 30 May 12

  37. No password sharing <- Happy security conscious user Wednesday, 30

    May 12
  38. Developers just need to implement a redirect and a POST

    request <- Happy developers Wednesday, 30 May 12
  39. Users can revoke access tokens for specific clients Wednesday, 30

    May 12
  40. Wednesday, 30 May 12

  41. Nefarious clients can have their credentials revoked and all associated

    access tokens destroyed immediately Wednesday, 30 May 12
  42. Wednesday, 30 May 12

  43. Wednesday, 30 May 12

  44. Currently version 1.0a lncn.eu/giy Wednesday, 30 May 12

  45. Version 2.0 is almost finished lncn.eu/bkw Wednesday, 30 May 12

  46. OAuth 2.0 •Simpler •Requires all communication over SSL •New flows

    •Better UX Wednesday, 30 May 12
  47. Who’s using OAuth? Wednesday, 30 May 12

  48. Wednesday, 30 May 12

  49. v1.0a and v2.0 v1.0a v1.0a v2.0 (prev v1.0a) v2.0 v2.0

    (prev v1.0a) v2.0 (prev v1.0a) v2.0 Wednesday, 30 May 12
  50. And in HE? Wednesday, 30 May 12

  51. Wednesday, 30 May 12

  52. Wednesday, 30 May 12

  53. Wednesday, 30 May 12

  54. data.lincoln.ac.uk people energy location printing events calendars bibliographic documents Wednesday,

    30 May 12
  55. Internal and external authorisation Wednesday, 30 May 12

  56. Single Sign-On Wednesday, 30 May 12

  57. Blackboard (SAML) Zendesk (SAML) Get Satisfaction (OAuth) WordPress (OAuth) Exchange

    (ADFS) Sharepoint (ADFS) Gmail (SAML) + OAuth clients (internal + external) Wednesday, 30 May 12
  58. Open source 2.0 server lncn.eu/ar6 Wednesday, 30 May 12

  59. Any questions? Wednesday, 30 May 12

  60. Thank you @alexbilbie Wednesday, 30 May 12