Elevating OAuth Security

Transcript

1. Charles Rea Elevating OAuth Security Slides: https://bit.ly/ddd-oauth-security
2. API 2⃣ Use Access Token to call API Client Authorization Server 1⃣ Client requests Access Token from AS
3. API 5⃣ Use Access Token to call API Client Authorization Server 1⃣ Redirect user to Authorization endpoint 2⃣ Redirect to Client with Authorization Code GET client.com/callback?code=abc1 3⃣ Use Authorization Code to call Token Endpoint 4⃣ Returns response to Client: Access Token [Refresh Token] [ID Token]
4. Why talk about security?
5. API 5⃣ Use Access Token to call API Client Authorization Server 1⃣ Redirect user to Authorization endpoint 2⃣ Redirect to Client with Authorization Code 3⃣ Use Authorization Code to call Token Endpoint 4⃣ Returns response to Client: Access Token [Refresh Token] [ID Token]
6. Authorization Server Client GET https://authorization-server.com/authorize? client_id=FGezBxZLjUIX0pU0Xv1hDigCfQJ2Eqk4& scope=openid profile read:bank_statement& callback_uri=https://client.com/callback& response_type=code& ... Authorization Request
7. Pushed Authorization Requests (PAR)
8. Authorization Server POST authorization params Back channel (server to sever) Front channel (browser) Client Redirect user to AS via front-channel
9. POST authorization params Redirect user to AS via front-channel Send request ID Back channel Front channel (browser) Returns request ID Client Authorization Server
10. POST https://authorization-server.com/par HTTP/1.1 Content-Type: application/x-www-form-urlencoded client_id=FGezBxZLjUIX0pU0Xv1hDigCfQJ2Eqk4& client_secret=JWxhiIuzQkEw5cmdDjAmpEU7EQHg2p-xS7LCU& scope=openid profile& callback_uri=https://client.com/callback& ... Authorization Server Client Application Pushed Authorization Request
11. HTTP/1.1 201 Created Cache-Control: no-cache, no-store Content-Type: application/json { "request_uri": "urn:example:bwc4JK-ESC0w8acc191e-Y1LTC2", "expires_in": 90 } Authorization Server Client Application Pushed Authorization Request
12. GET https://authorization-server.com/authorize? client_id=FGezBxZLjUIX0pU0Xv1hDigCfQJ2Eqk4& request_uri=urn:example:bwc4JK-ESC0w8acc191e-Y1LTC2 Authorization Server Client Application Pushed Authorization Request
13. POST authorization params via backchannel Redirect user to AS via front-channel Send request ID Back channel Front channel (browser) Returns request ID Client Authorization Server
14. API 5⃣ Use Access Token to call API Client Authorization Server 1⃣ Redirect user to Authorization endpoint 2⃣ Redirect to Client with Authorization Code GET client.com/callback?code=abc1 3⃣ Use Authorization Code to call Token Endpoint 4⃣ Returns response to Client: Access Token [Refresh Token] [ID Token]
15. POST https://authorization-server.com/token HTTP/1.1 Content-Type: application/x-www-form-urlencoded grant_type=authorization_code client_id=FGezBxZLjUIX0pU0Xv1hDigCfQJ2Eqk4 client_secret=JWxhiIuzQkEw5cmdDjAmpEU7EQHg2p-xS7LCUFB code=cZRZfGxi6-zYCUdnzJxF35tk_1p7Zr__So-IJkKrDeicc Obtaining an Access Token
16. POST https://authorization-server.com/token HTTP/1.1 Content-Type: application/x-www-form-urlencoded grant_type=authorization_code client_id=FGezBxZLjUIX0pU0Xv1hDigCfQJ2Eqk4 client_secret=JWxhiIuzQkEw5cmdDjAmpEU7EQHg2p-xS7LCUFB code=cZRZfGxi6-zYCUdnzJxF35tk_1p7Zr__So-IJkKrDeicc Obtaining an Access Token
17. Asymmetric Client Authentication 1⃣ Generate public-private key pair for client 3⃣ Client uses private key to generate assertion & calls token endpoint 4⃣ Authorization Server validates assertion using public key 2⃣ Register public key with Authorization Server
18. Private Key JWT Client Authentication
19. JWT.sign({ "iat": now(), "iss": "my client id", "sub": "my client id", "aud": "https://authorization-server.com/", "exp": now().add("60s"), "jti": uuidv4(), }, privateKey); eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3OD kwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxw RJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
20. POST https://authorization-server.com/token HTTP/1.1 Content-Type: application/x-www-form-urlencoded grant_type=authorization_code client_id=FGezBxZLjUIX0pU0Xv1hDigCfQJ2Eqk4 client_assertion_type= urn:ietf:params:oauth:client-assertion-type:jwt-bearer client_assertion=eyJhbGciOi... code=cZRZfGxi6-zYCUdnzJxF35tk_1p7Zr__So-IJkKrDeicc
21. Alternative approach: Mutual TLS (mTLS)
22. API 5⃣ Use Access Token to call API Client Authorization Server 1⃣ Redirect user to Authorization endpoint 2⃣ Redirect to Client with Authorization Code GET client.com/callback?code=abc1 3⃣ Use Authorization Code to call Token Endpoint 4⃣ Returns response to Client: Access Token [Refresh Token] [ID Token]
23. GET https://my-api.com/ HTTP/1.1 Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6I... Calling the API
24. 3⃣ Call API with access token & proof of possession of key API Client Authorization Server 1⃣ Token request with proof of possession of a key 2⃣ Access token bound to key Client key
25. Demonstrating Proof of Possession (DPoP)
26. DPoP Proof JWT signed by Private Key Bound to the current request Bound to the access token Contains Public Key Issued time Unique ID
27. { "typ": "dpop+jwt", "alg": "RS256", "jwk": { "kty": "RSA", "n": "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx...", "e": "AQAB" } } { "jti": "-BwC3ESc6acc2lTc", "htm": "POST", "htu": "https://authorization-server.com/token", "iat": 1562262616 }
28. { ... "cnf": { "jkt": "0ZcOCORZNYy-DWpqq30jZyJGHTN0d2..." } ... } Binding Token to Key
29. 3⃣ Call API with access token & proof of possession of key API Client Authorization Server 1⃣ Token request with JWT proof of possession of a key 2⃣ Access token bound to key Client key
30. DPoP + Public Clients
31. Tying it together… Integrity Protection Sender constrained tokens Hiding confidential info from browser Public Key Cryptography
32. Tying it together… FAPI - Financial Grade
33. Want to know more? PAR - RFC 9126 DPoP - RFC 9449 FAPI Specifications Private Key JWT - RFC 7521 & RFC 7523
34. Charles Rea Thank you! Slides: https://bit.ly/ddd-oauth-security