Authentication in Web, API-based & Distributed Environments

Transcript

1. AUTHENTICATION IN WEB, API-BASED &
   DISTRIBUTED ENVIRONMENTS
   NIKO KÖBLER (@DASNIKO)
   

   View Slide

2. ABOUT ME
   ▸ Freelance Consultant/Architect/Developer/Trainer @ www.n-k.de
   ▸ Doing stuff with & without computers, writing Software, > 20 yrs
   ▸ Co-Lead of JUG DA (https://www.jug-da.de / @JUG_DA)
   ▸ Speaker at international Tech Conferences
   ▸ Author of „Serverless Computing in AWS Cloud“
   serverlessbuch.de
   ▸ Twitter: @dasniko
   SSO & AUTHENTICATION IN API-BASED ENVIRONMENTS
   

   View Slide

3. AUTHENTICATION
   AUTHORIZATION
   

   View Slide

4. View Slide

5. ?
   

   View Slide

6. View Slide

7. View Slide

8. View Slide

9. View Slide

10. View Slide

11. View Slide

12. OAUTH2
    AUTHORIZATION, NOT AUTHENTICATION!
    The OAuth 2.0 authorization framework enables
    a 3rd-party application to obtain limited access
    to an HTTP service.
    IETF, RFC 6749, 2012
    

    View Slide

13. OAUTH2 GRANT TYPES
    GRANT TYPE APPS
    Authorization Code Web, Apps
    Implicit JavaScript, etc.
    Resource Owner Password Credentials Apps
    Client Credentials Web
    Refresh Web, Apps
    

    View Slide

14. OAUTH2 TERMS
    Resource Owner
    Client
    Authorization Server
    Resource Server
    Redirect URI
    Response Type
    Scope
    Consent
    Client ID
    Client Secret
    Authorization Code
    Access Token
    

    View Slide

15. View Slide

16. ACCESS TOKEN
    {
    "access_token": "6041a9d7-8c39-4945-b7c6-eaf7bd5d0907",
    "token_type": "Bearer",
    "expires_in": 3600,
    "refresh_token": "e339b569-6d95-482d-9534-5c0147136ab0"
    }
    

    View Slide

17. OPEN ID CONNECT
    AUTHENTICATION LAYER ON TOP OF OAUTH 2.0
    ‣ verify the identity of an end-user
    ‣ obtain basic profile information about the user
    ‣ RESTful HTTP API, using JSON as data format
    ‣ allows clients of all types (web-based, mobile, JavaScript)
    OPENID FOUNDATION, 2014
    

    View Slide

18. OIDC
    {
    "access_token": "6041a9d7-8c39-4945-b7c6-eaf7bd5d0907",
    "token_type": "Bearer",
    "expires_in": 3600,
    "identity_token": "???",
    "refresh_token": "e339b569-6d95-482d-9534-5c0147136ab0"
    }
    OPENID CONNECT ADDS THE IDENTITY TOKEN
    

    View Slide

19. JWT
    JSON WEB TOKEN
    RFC 7519 STANDARD, 2015
    

    View Slide

20. JWT
    eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOi
    IxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiY
    WRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrH
    DcEfxjoYZgeFONFh7HgQ
    BASE64 ENCODED
    

    View Slide

21. JSON WEB TOKEN
    

    View Slide

22. JWT PAYLOAD
    {
    "sub": "1234567890",
    "iss": "https://sso.myapi.com",
    "aud": "myApi",
    "exp": 1479814753,
    "name": "John Doe",
    "admin": true
    }
    RESERVED CLAIMS:
    sub, iss, aud, exp
    

    View Slide

23. OPEN ID CONNECT STANDARD CLAIMS
    http://openid.net/specs/openid-connect-core-1_0.html
    

    View Slide

24. ACCESS TOKEN
    {
    "access_token": "6041a9d7-8c39-4945-b7c6-eaf7bd5d0907",
    "token_type": "Bearer",
    "expires_in": 3600,
    "identity_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "refresh_token": "e339b569-6d95-482d-9534-5c0147136ab0"
    }
    

    View Slide

25. View Slide

26. View Slide

27. View Slide

28. View Slide

29. THANK YOU.
    ANY QUESTIONS?
    Slides: https://speakerdeck.com/dasniko
    Niko Köbler | www.n-k.de | niko@n-k.de | @dasniko
    SSO & AUTHENTICATION IN API-BASED ENVIRONMENTS
    

    View Slide