Getting_OAuth_Into_Your_Dev_Toolbox.pdf

Transcript

1. Getting OAuth Into Your Dev Toolbox BRETT BERLINER
2. Who Am I? Brett Berliner bberliner@cardinalsolutions.com @bberliner github.com/brettberliner Presentation Available: speakerdeck.com/bberliner
3. What is OAuth? Open Authorization Simple design, heavy adoption Controversial
4. OAuth Flow Image courtesy of: https://code.tutsplus.com/articles/oauth-20-the-good-the-bad-the-ugly--net-33216
5. Why Use OAuth? Good Developers Who Can Use OAuth Can Can't
6. OAuth Issues • Too permissive • Endpoint discovery impossible • Authentication is NOT the “Auth” • Security is an afterthought
7. Why Listen To Me?
8. OAuth Horror Story: The Case of the Empty Toolbox
9. Postman – Your New Best Friend
10. OAuth Horror Story II : Attack of the Noobs
11. Grant Types (grant_type) • Authorization code • Implicit • Client credentials • Resource owner password • Refresh tokens
12. Token Design This is pretty standard, but token design is different per application, flow, consumer, etc
13. JWT Tokens (jwt.io)
14. OAuth Horror Story The Third: Authorization, Not Authentication
15. Claims Based Authentication Provider packages claims into tokens Usage in OAuth is standard Not what the subject can or can’t do, what it is or isn’t Standard: sub, iss, aud {"userid" : "testuser"} eyJ1c2VyaWQiIDogInRlc3R1c2VyIn0=
16. OAuth Horror Story IV: Failing Gracefully
17. So, Where Do We Start?
18. The Common Theme of All These Horror Stories… Thinking of OAuth as the design, instead of a tool
19. Best Practice - Design OAuth Simultaneously
20. OAuth Horror Story – The Final Chapter: Decisions, Decisions
21. Pick Your Grant Types & Flows
22. Pick a Token Type (and stick to it) OAuth can easily use either! JWT Simple Stateless Standard Mobile friendly Non-JWT Bearer Tokens Also Simple Refreshable/Revocable Non-Standard/Extensible Secure
23. Token Storage & Authentication • Design claims if necessary • Storing tokens is helpful, but problematic • How will consumers use them?
24. Don’t Forget Endpoints, Status Codes & URLs
25. Tools - .NET Identity Server
26. .NET Core Quickstart
27. Identity Server Quickstart – Startup.cs
28. Identity Server Quickstart – Startup.cs
29. Tools - Java
30. Tools - Javascript OAuth-JS – and…?
31. Final Takeaways Design your system up front OAuth is a tool! Just get started
32. More Reading https://oauth.net/articles/authentication/ https://alexbilbie.com/guide-to-oauth-2-grants/ http://oltu.apache.org/ https://github.com/spring-projects/spring-security-oauth https://github.com/aspnetcontrib/AspNet.Security.OpenIdConnect.Server https://code.tutsplus.com/articles/oauth-20-the-good-the-bad-the-ugly--net-33216 http://docs.identityserver.io https://github.com/oauth-io/oauth-js