Integrating Services with OAuth2.0

© 2013 Adobe Systems Incorporated. All Rights Reserved. Adobe Con
dential. © 2011 Adobe Systems Incorporated. All Rights Reserved. Adobe Con dential. Integrating Services with OAuth2.0 Brent Shaﬀer | Web Services Thursday, January 31, 13

dential. § What is OAuth? § Why does OAuth exist? § What is so great about the 2.0 version? § What does it look like? 2 Why am I here? Thursday, January 31, 13

Thursday, January 31, 13

dential. 17 Don’t require your users to authenticate with 3rd parties using plaintext passwords! e moral of the story Thursday, January 31, 13

dential. 18 OAuth Thursday, January 31, 13

dential. 19 ree Legs Thursday, January 31, 13

dential. 19 ree Legs USER Thursday, January 31, 13

dential. 19 ree Legs USER SERVICE Thursday, January 31, 13

dential. 19 ree Legs USER 3RD PARTY SERVICE Thursday, January 31, 13

dential. 20 Tokens Thursday, January 31, 13

dential. 21 § tokens are a representation of credentials § no trusting 3rd parties with passwords § can authorize only certain types of access (scope) § user can revoke access on client level § the user is driving this train Thursday, January 31, 13

dential. 22 OAuth 1.0 - Pain Points Thursday, January 31, 13

dential. 23 Signatures Thursday, January 31, 13

dential. 24 Busted Libraries Thursday, January 31, 13

dential. 25 Solution? Thursday, January 31, 13

dential. 26 Refresh Tokens § Replaces encryption with expiration § Retrieves new tokens without requesting authorization § Relies on SSL for everything else Thursday, January 31, 13

dential. 27 Extensibility § Grant Types § Return Types § Token Types § Assertion Types Thursday, January 31, 13

dential. 28 Deep Dive Thursday, January 31, 13

dential. 29 User Client Server Roles “3rd Party” “Resource and Authorization Provider” “Resource Owner” Thursday, January 31, 13

dential. 30 Authorize Token Resource ree Endpoints e user authorizes the client e server returns a token to the client e server provides the resource Thursday, January 31, 13

dential. 31 Choose Your Grant Type Thursday, January 31, 13

dential. 32 Thursday, January 31, 13

dential. 33 Client Authorization Code Thursday, January 31, 13

dential. 33 Client Authorization Request Authorization Code Thursday, January 31, 13

dential. 33 Client Authorization Request Authorize Authorization Code Thursday, January 31, 13

dential. 33 Client Authorization Request Authorization Code Authorize Authorization Code Thursday, January 31, 13

dential. 33 Client Authorization Request Authorization Code Authorization Code Authorize Authorization Code Thursday, January 31, 13

dential. 33 Client Authorization Request Authorization Code Authorization Code Authorize Token Authorization Code Thursday, January 31, 13

dential. 33 Client Authorization Request Authorization Code Authorization Code Access Token Authorize Token Authorization Code Thursday, January 31, 13

dential. 33 Client Authorization Request Authorization Code Authorization Code Access Token Access Token Authorize Token Authorization Code Thursday, January 31, 13

dential. 33 Client Authorization Request Authorization Code Authorization Code Access Token Access Token Authorize Token Resource Authorization Code Thursday, January 31, 13

dential. 33 Client Authorization Request Authorization Code Authorization Code Access Token Access Token Protected Resource Authorize Token Resource Authorization Code Thursday, January 31, 13

dential. 34 Client Authorize Authorization Code GET /authorize ?response_type=code &client_id=s6BhdRkqt3 HTTP/1.1 Host: server.example.com Thursday, January 31, 13

dential. 35 Client Authorize Authorization Code HTTP/1.1 302 Found Location: http://example.com/cb ?code=SplxlOBeZQQYbYS6WxSbIA Thursday, January 31, 13

dential. 36 Client Token Authorization Code POST /token HTTP/1.1 Host: server.example.com Authorization: Basic czZCaGRSa3F0Mzp Content-Type: application/x-www-form-urlencoded grant_type=authorization_code &code=SplxlOBeZQQYbYS6WxSbIA Thursday, January 31, 13

dential. 37 Client Token Authorization Code HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Cache-Control: no-store Pragma: no-cache { "access_token":"2YotnFZFEjr1zCsicMWpAA", "token_type":"bearer", "expires_in":3600 } Thursday, January 31, 13

dential. 38 Client Resource Authorization Code GET /resource/1 HTTP/1.1 Host: example.com Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA Thursday, January 31, 13

dential. 39 Client Resource Authorization Code HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 { "resource":"foo", "value":"bar", "success":true } Thursday, January 31, 13

dential. 42 Client Resource Owner Username / Password Access Token Access Token Protected Resource Token Resource Resource Owner Password Credentials Thursday, January 31, 13

dential. 43 Client Resource Owner Username / Password Token Authorization Code POST /token HTTP/1.1 Host: server.example.com Authorization: Basic czZCaGRSa3F0Mzp Content-Type: application/x-www-form-urlencoded grant_type=password &username=foo &password=bar Thursday, January 31, 13

dential. 45 Client Client Credentials Access Token Access Token Protected Resource Token Resource Client Credentials Thursday, January 31, 13

dential. 46 Client Token Client Credentials POST /token HTTP/1.1 Host: server.example.com Authorization: Basic czZCaGRSa3F0Mzp Content-Type: application/x-www-form-urlencoded grant_type=client_credentials Client Credentials Thursday, January 31, 13

dential. 48 § When your Access Token expires, get another one! § When your Refresh Token expires, start over Refresh Token Thursday, January 31, 13

dential. 49 Client Token Authorization Code HTTP/1.1 200 OK Content-Type: application/json;charset=UTF-8 Cache-Control: no-store Pragma: no-cache { "access_token":"2YotnFZFEjr1zCsicMWpAA", "token_type":"bearer", "expires_in":3600, “refresh_token”: “tGzv3JOkF0XG5Qx2TlKWIA“ } Thursday, January 31, 13

dential. 50 Client Refresh Token Access Token Access Token Protected Resource Token Resource Refresh Token Thursday, January 31, 13

dential. 51 Client Token Refresh Token POST /token HTTP/1.1 Host: server.example.com Authorization: Basic czZCaGRSa3F0Mzp Content-Type: application/x-www-form-urlencoded grant_type=refresh_token &refresh_token=tGzv3JOkF0XG5Qx2TlKWIA Refresh Token Thursday, January 31, 13

dential. 53 Redirects a. registered by the client b. provided by the client in the redirect_uri querystring parameter to the authorize endpoint c. both* *Server validates the querystring redirect URI against the registered redirect URI A redirect URI is... Thursday, January 31, 13

dential. 54 Client Authorize Redirects GET /authorize ?response_type=token &client_id=s6BhdRkqt3 &redirect_uri=https://example.com/cb HTTP/1.1 Host: server.example.com Thursday, January 31, 13

dential. 55 Redirects If sent in the querystring, the redirect_uri must also be supplied to the token endpoint Thursday, January 31, 13

dential. 56 Client Token Redirects POST /token HTTP/1.1 Host: server.example.com Authorization: Basic czZCaGRSa3F0Mzp Content-Type: application/x-www-form-urlencoded grant_type=authorization_code &code=SplxlOBeZQQYbYS6WxSbIA &redirect_uri=https://example.com/cb Thursday, January 31, 13

dential. 58 Scope § scope is what the user has authorized the client to do § sent as part of the authorize request § granted as part of the token request § validated as part of the resource request Thursday, January 31, 13

dential. 59 Client Authorize Scope GET /authorize ?response_type=token &client_id=s6BhdRkqt3&state=xyz &redirect_uri=https://example.com/cb &scope=somescope HTTP/1.1 Host: server.example.com Thursday, January 31, 13

dential. 61 State § Q: What happens if UserA grants an authorization code to ClientA, and tricks UserB to follow the redirection? § A: UserB would be associated with UserA’s resources! § state is a querystring parameter consisting of a CSRF token, which is passed back to the client for validation Thursday, January 31, 13

dential. 62 Client Authorize State GET /authorize ?response_type=token &client_id=s6BhdRkqt3&state=xyz &redirect_uri=https://example.com/cb &state=xyz HTTP/1.1 Host: server.example.com Thursday, January 31, 13

dential. 63 Client Authorize State HTTP/1.1 302 Found Location: http://example.com/cb ?code=2YotnFZFEjr1zCsicMWpAA &state=xyz Thursday, January 31, 13

dential. 64 Criticism Thursday, January 31, 13

dential. 65 OAuth2.0 Protocol Framework Thursday, January 31, 13

dential. 66 Interoperability “this speci cation is likely to produce a wide range of non-interoperable implementations.” Thursday, January 31, 13

dential. 67 Refresh Tokens § Requires extra round trip to authorization server § Additional client-side implementation logic Thursday, January 31, 13

dential. 68 Security § Depends on SSL for encryption § Outsources security to the Client § Less Secure than OAuth 1.0 Thursday, January 31, 13

dential. 69 Security “Every security expert will tell you to layer your security” Eran Hammer Thursday, January 31, 13

dential. 70 Defense Thursday, January 31, 13

dential. 71 Defense Thursday, January 31, 13

dential. 72 Defense § Built for the Enterprise § Implement only the Grant Types needed § Complicated for server, simple for client “It’s a Framework, not a Protocol! It’s Too Complicated!” Thursday, January 31, 13

dential. 73 Defense § Framework is extensible § We can implement MAC Tokens, JWT tokens, etc “It’s not secure!” Thursday, January 31, 13

dential. Thursday, January 31, 13

Integrating Services with OAuth2.0

Integrating Services with OAuth2.0

More Decks by Brent Shaffer

Other Decks in Technology

Featured

Transcript